Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.
Summary
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xorbitsai | inference | before 2.7.0 | 2.7.0 | Patch available | CNA |
| — | xinference (PyPI) | before 2.7.0 | 2.7.0 | Patch available | GHSA-x2rj-828p-hx9m |
- inference Vendorxorbitsai Affected before 2.7.0 Fixed in 2.7.0 Patch available CNA
- xinference (PyPI) Vendor— Affected before 2.7.0 Fixed in 2.7.0 Patch available GHSA-x2rj-828p-hx9m
Remediation
- Fix · CNA inference (xorbitsai) Fixed in 2.7.0
- Fix · GHSA-x2rj-828p-hx9m xinference (PyPI) Fixed in 2.7.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61539
- 2026-10-03 Alias added: GHSA-x2rj-828p-hx9m
References
Other 5
- https://github.com/xorbitsai/inference/security/advisories/GHSA-x2rj-828p-hx9m
- https://github.com/xorbitsai/inference/pull/4786
- https://github.com/xorbitsai/inference/commit/1b3d220f342ce68d34cec4586d9409d457dadc42
- https://github.com/xorbitsai/inference/releases/tag/v2.7.0
- https://github.com/xorbitsai/inference
More xorbitsai vulnerabilities
- TI-2026-58780 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register CVSS 4.0HIGH 8.7
- TI-2026-73470 Unauthenticated deserialization RCE in Xorbits Xoscar actor pool CVSS 4.0CRITICAL 9.3
- TI-2026-53677 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders CVSS 4.0HIGH 8.7
- TI-2026-76179 Path traversal in Xinference lets attackers write and delete JSON files CVSS 4.0HIGH 8.3
Sources
- CVE-2026-61539 · CVE Program
- CVE-2026-61539 · NVD
- FIRST EPSS
- GHSA-x2rj-828p-hx9m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences