Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-61539: Xinference may let attackers run code on server via chat API
CVE-2026-61539 · published 13 days ago
Summary
The Xinference service processes chat requests and, in its default setup, runs a piece of code that can interpret text as a program. An attacker who can send specially crafted chat prompts can cause the server to execute that code, potentially taking control of the system. To protect yourself, enable authentication, restrict who can call the chat endpoint, and update the software to a version that removes the unsafe code parsing.
What to do
- Update xinference to version 2.7.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | xorbitsai | inference | < 2.7.0 |
| pip | – | xinference |
<= 2.5.0 Fix: upgrade to 2.7.0
|
Original advisory text
Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.
References
- https://github.com/xorbitsai/inference/security/advisories/GHSA-x2rj-828p-hx9m x_refsource_CONFIRM
- https://github.com/xorbitsai/inference/pull/4786 x_refsource_MISC
- https://github.com/xorbitsai/inference/commit/1b3d220f342ce68d34cec4586d9409d457... x_refsource_MISC
- https://github.com/xorbitsai/inference/releases/tag/v2.7.0 x_refsource_MISC
- https://github.com/advisories/GHSA-x2rj-828p-hx9m
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61539... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61539 Vendor Advisory
Severity
10.0
Critical
CVSS 3.1: 10.0 (MITRE)
Exploitation
EPSS <1%
Type
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Timeline
Published21 Aug 2026
Updated3 Sep 2026
First seen21 Aug 2026
Monitor software like this
Free during beta