Critical, CVSS 10.0PyPIAmendedPublished
Xinference vulnerable to remote code execution via unsafe eval() in Llama3 tool-call parsing
CVE-2026-61539 · GHSA-x2rj-828p-hx9m
- Affected
- PyPI xinference <= 2.5.0
- Fixed in
- 2.7.0· Vendor fix available
- Issue
- Xinference used Python's unsafe eval() function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to return a Python expression. Xinference then evaluates that expression on the server while post-processing the tool-call result. In the tested default deployment, authentication was not enabled, so the vulnerability was exploitable by an unauthenticated remote attacker through the /v1/chat/completions endpoint. Details Users can interact with deployed models through Xinference's OpenAI-compatible /v1/chat/completions API. The request entry point is implemented in xinference/api/restfulapi.py; non-streaming requests call the model instance's chat() method and return the inference result. When the Transformers backend is used, inference results flow through the batching logic in…
Recommended action: Upgrade to 2.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.