Xinference bug lets attackers run code via eval()

Xinference feeds Llama3 tool-call output straight into Python's eval() during post-processing, per GHSA-x2rj-828p-hx9m (CVE-2026-61539), published August 21.

CVSS scored the flaw a perfect 10.0. That's unauthenticated remote code execution, reachable through /v1/chat/completions, an endpoint that ships with authentication off by default.

Model output is steerable by prompt. An attacker can steer the model into returning a Python expression, and Xinference executes it directly on the server.

The bug hits every Xinference deployment up to version 2.5.0. It's fixed in 2.7.0.

The vulnerable code is the parser reading tool-call output. Xinference ran the model's returned text as executable Python instead of treating it as inert data.

The advisory doesn't say how widely 2.5.0 and earlier were deployed, or whether anyone exploited the bug before the fix shipped. It also doesn't cover Xinference's other model backends, only that the Llama3 tool-call path was wired to eval.

Running Xinference means upgrading to 2.7.0 and checking whether the endpoint has authentication turned on, since the default is off.