Xinference scores CVSS 10.0 for unauthenticated RCE through eval() in Llama3 tool-call parsing

GitHub Security Advisories·high signalXBlueskyLinkedInCopy link

GHSA-x2rj-828p-hx9m (CVE-2026-61539), published 21 August 2026, describes Xinference passing Llama3 tool-call output to Python's eval() during post-processing. Because model output is steerable by prompt, an attacker can get a Python expression returned and executed server-side via /v1/chat/completions, which ships with authentication off by default. Versions up to 2.5.0 are affected; the fix is 2.7.0. This is the cleanest example yet of the tool-call parser being the exploitable surface rather than the tool itself.