CVE-2026-76841

HighCVSS 8.8

Published: 24/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 24/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.71%

51th percentile - higher than 51% of all known CVEs

Summary

Xinference enables remote code execution by default when loading Hugging Face models, and before version 2.12.0 there is no setting to disable it. An attacker with model launch access can execute arbitrary code.

Risk Assessment

A person with permissions to launch models can register a malicious model and execute code in the worker process, potentially leading to server compromise or data theft.

Recommendation

Update Xinference to version 2.12.0 or later, which disables remote code execution by default. Restrict model loading access to trusted users only.

Other vulnerabilities in Xinference

CVE-2026-61539Critical
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.

Original NVD description (English source)

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._get_tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence_transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence_transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches _auto_detect_type and then AutoTokenizer.from_pretrained, which imports and executes Python declared by the model directory's own tokenizer_config.json auto_map, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code only for bundled built-in models.