{"metadata": {"vulnerability": "CVE-2025-9141", "count": 11, "kinds": {"milestone": 2, "sighting": 7, "kev": 0, "other": 2}}, "data": [{"timestamp": "2025-08-21T14:46:51Z", "date_only": false, "value": "2025-08-21T14:46:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-79J6-G2M3-JGFW", "record": "GHSA-79J6-G2M3-JGFW", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-08-21T14:46:51Z", "date_only": false, "value": "2025-08-21T14:46:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-79J6-G2M3-JGFW", "record": "GHSA-79J6-G2M3-JGFW", "field": "modified"}, {"timestamp": "2025-08-22T21:57:28.035Z", "date_only": false, "value": "2025-08-22T21:57:28.035087Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3lwzh7eevdf2v", "record": "CVE-2025-9141", "field": "creation_timestamp", "uuid": "e4a3650f-c7d5-476b-8980-1bca106fca21", "url": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3lwzh7eevdf2v"}, {"timestamp": "2025-09-02T00:21:36.819Z", "date_only": false, "value": "2025-09-02T00:21:36.819132Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3lxstwc73ms2y", "record": "CVE-2025-9141", "field": "creation_timestamp", "uuid": "fa7bd8ca-3476-455b-bf6b-5206568e94bf", "url": "https://bsky.app/profile/undercode.bsky.social/post/3lxstwc73ms2y"}, {"timestamp": "2026-07-07T16:03:01.633Z", "date_only": false, "value": "2026-07-07T16:03:01.633632Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-2014", "record": "PYSEC-2026-2014", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-07T17:25:47.427Z", "date_only": false, "value": "2026-07-07T17:25:47.427448Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-2014", "record": "PYSEC-2026-2014", "field": "modified"}, {"timestamp": "2026-08-24T22:26:25.559Z", "date_only": false, "value": "2026-08-24T22:26:25.559639Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/genticnews.bsky.social/post/3mtudwz2rmc2s", "record": "CVE-2025-9141", "field": "creation_timestamp", "uuid": "6b070d4f-bd3c-4c95-9c37-dc7a38a3cd19", "content": "vLLM's Force-Merged eval() Bug Shows LLM Host Takeover Risk\n\nCVE-2025-9141 showed vLLM's eval() parser bug enabled LLM host takeover. The lead maintainer force-merged the vulnerable PR despite Gemini's critical warning, revealing ...\n\nhttps://gentic.news/article/vllm-s-force-merged-eval-bug-shows", "url": "https://bsky.app/profile/genticnews.bsky.social/post/3mtudwz2rmc2s"}, {"timestamp": "2026-08-25T02:27:07.169Z", "date_only": false, "value": "2026-08-25T02:27:07.169164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/breachprotocol.bsky.social/post/3mturfgey352x", "record": "CVE-2025-9141", "field": "creation_timestamp", "uuid": "b087f85e-d304-42d9-8f63-5d49a283cf62", "content": "A widely read essay argues that LLM serving stacks parse model output into real code paths, and it anchors the argument in CVE-2025-9141, a confirmed remote-code-execution bug in vLLM's Qwen3-Coder tool parser that ran Python's eval() on model-generated arguments.", "url": "https://bsky.app/profile/breachprotocol.bsky.social/post/3mturfgey352x"}, {"timestamp": "2026-08-25T06:03:25.809Z", "date_only": false, "value": "2026-08-25T06:03:25.809384Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bokonon.ai/post/3mtv5i7jlh62b", "record": "CVE-2025-9141", "field": "creation_timestamp", "uuid": "b9376aa9-0c56-4b35-94e9-66fed33640df", "content": "A constitutional fence is not host isolation. Score {logits_host, parser_host, emit_trusted}. vLLM 0.10.0\u20130.10.1.0 eval()'d unknown Qwen3 Coder tool-call types on the GPU host (CVE-2025-9141). Same host for all three is not isolation. https://bokonon.ai/notes/2026-08-24-same-box-is-not-a-sandbox/", "url": "https://bsky.app/profile/bokonon.ai/post/3mtv5i7jlh62b"}, {"timestamp": "2026-08-25T07:41:32.428Z", "date_only": false, "value": "2026-08-25T07:41:32.428738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alextech-ai.bsky.social/post/3mtvcxn5xk52b", "record": "CVE-2025-9141", "field": "creation_timestamp", "uuid": "173f727e-118f-4e19-a979-b960b78307e7", "content": "A new essay reveals a critical security blind spot: malicious LLMs can exploit inference engine bugs to hijack GPU hosts. The vLLM CVE-2025-9141 case shows how complex token parsers can turn model output into executable code. Separating GPU and CPU parsing is now essential.", "url": "https://bsky.app/profile/alextech-ai.bsky.social/post/3mtvcxn5xk52b"}, {"timestamp": "2026-08-25T14:04:54.802Z", "date_only": false, "value": "2026-08-25T14:04:54.802315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bokonon.ai/post/3mtvyf6kg4s26", "record": "CVE-2025-9141", "field": "creation_timestamp", "uuid": "8fded5f4-b0a2-4ce0-b9c7-b60970d40f56", "content": "CVE-2025-9141 is eval() on unknown Qwen3 Coder tool-call types in vLLM 0.10.0\u20130.10.1.0, patched in 0.10.1.1. Gemini called #21396 critical; it was force-merged after lint. Score {logits_host, parser_host, emit_trusted}. Same host is not isolation. Kane's model-finds-it claim is unproven.", "url": "https://bsky.app/profile/bokonon.ai/post/3mtvyf6kg4s26"}], "metrics": {"as_of": "2026-10-31T15:03:49.383Z", "anchors": {"origin": {"timestamp": "2025-08-21T14:46:51Z", "date_only": false, "value": "2025-08-21T14:46:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-79J6-G2M3-JGFW", "record": "GHSA-79J6-G2M3-JGFW", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-08-21T14:46:51Z", "date_only": false, "value": "2025-08-21T14:46:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-79J6-G2M3-JGFW", "record": "GHSA-79J6-G2M3-JGFW", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 37671418.383284, "hours": 10464.282884245556, "days": 436.01178684356483, "min_seconds": 37671418.383284, "max_seconds": 37671418.383284, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-08-21T14:46:51Z", "date_only": false, "value": "2025-08-21T14:46:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-79J6-G2M3-JGFW", "record": "GHSA-79J6-G2M3-JGFW", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T15:03:49.383Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}