www.lesswrong.com/posts/CjeobBGnhxg8xvden/llms-could-control-their-host-machines...
1 correction found
The parser passed almost every tool-call argument to eval(), allowing the LLM to execute arbitrary code on the host machine.
This overstates the bug: the introduced parser did not send "almost every" argument to `eval()`. In the code and the official advisory, `eval()` appears only in a fallback path for certain non-primitive parameter types after safer parsing fails.
Full reasoning
The RCE vulnerability was real, but this sentence misdescribes how broadly eval() was applied.
In the PR that introduced the parser, arguments typed as strings are returned directly; integers/floats/booleans are parsed with int(), float(), or boolean checks. eval() appears only in the final fallback branch for object/dict-like values, and only after json.loads() fails. That is not "almost every tool-call argument."
The project’s own security advisory describes the vulnerable path more narrowly: the eval() code path is reached when the parameter type is not explicitly defined or recognized. So while the bug could enable arbitrary code execution, the article overstates the implementation details by implying eval() was the default handling for nearly all arguments.
In short: the vulnerability existed, but the claim that the parser passed almost every argument to eval() is contradicted by both the introducing code and the official advisory.
2 sources
- Patch for vllm-project/vllm PR #21396
if param_type in ["string", ...]: return param_value ... elif param_type.startswith("int") ... int(param_value) ... elif param_type.startswith("num") or param_type.startswith("float"): ... elif param_type in ["boolean", "bool", "binary"]: ... else: if param_type == "object" or param_type.startswith("dict"): try: param_value = json.loads(param_value) ... try: param_value = eval(param_value) ...
- Remote code execution in the vllm tool call parser for Qwen3-Coder
vLLM's Qwen3 Coder tool parser contains a code execution path that uses Python's `eval()` function to parse tool call parameters... This code path is reached when: ... 3. The parameter type is not explicitly defined or recognized.