Skip to content

Xinference CVE-2026-61539: RCE via unsafe eval() in Llama3 tool-call parsing

Summary

A critical (CVSS 10.0) unauthenticated remote code execution flaw in Xinference (xorbitsai/inference, the open-source AI inference server; PyPI package xinference) was published to the GitHub Advisory Database on August 21, 2026 as CVE-2026-61539 / GHSA-x2rj-828p-hx9m. In affected versions, the Llama3 tool-call parser parsed model-generated tool-call output with Python's eval(), so an attacker who can influence LLM output (direct chat input or prompt injection through the OpenAI-compatible /v1/chat/completions API) can make the server execute arbitrary Python in the Xinference process context. In the tested default deployment, authentication was not enabled, so exploitation required no credentials.

Field Value
Advisory GHSA-x2rj-828p-hx9m
CVE CVE-2026-61539
Severity / CVSS Critical / 10.0 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code — "Eval Injection")
Affected xinference <= 2.5.0 (PyPI; GitHub releases line)
Fixed in 2.7.0 (PyPI release 2026-04-25; fix merged as PR #4786, commit 1b3d220, 2026-04-14)
Published 2026-08-21 (GitHub Advisory Database); no in-the-wild exploitation or actor attribution reported

Tags

Why this matters

  • Xinference is a widely deployed AI inference serving platform (OpenAI-compatible API, multi-model, multi-backend). Anything that routes attacker-influenced text into a Llama3-family model hosted on it — including proxying third-party or user-supplied prompts — can reach this primitive: the model output is treated as executable Python.
  • This is a prompt-to-code bridge: a classic prompt-injection or tool-call-confusion payload no longer needs a separate sink; the product's own post-processing evaluates model output. The advisory's default-configuration finding (no auth on the API) means exposed instances are one crafted request away from full host compromise.
  • The flaw was fixed in April 2026 but the CVE/advisory only landed in August. Instances pinned to xinference <= 2.5.0 have likely been silently vulnerable for months; treat this as a patch-now, verify-exposure item, not a fresh exploit window.
  • Context for defenders: the same xinference package was also the target of an April 2026 TeamPCP-attributed PyPI compromise (malicious 2.6.0–2.6.2 with a credential collector). The two issues are independent — a supply-chain supply of malicious releases versus a product vulnerability in the tool-call parser — but an environment running xinference is a high-value target for both, and a 10.0 RCE on inference hosts makes the supply-chain story worse, not better.

Mechanism

Attack path per the advisory: 1. Attacker sends a crafted chat-completion request (with tools) to the OpenAI-compatible /v1/chat/completions endpoint; entry point is xinference/api/restful_api.py. 2. For the Transformers backend, non-streaming results flow through handle_chat_result_non_streaming() in xinference/model/llm/transformers/core.py; when the request includes tools, _post_process_completion() invokes the Llama3 tool-call parser. 3. xinference/model/llm/tool_parsers/llama3_tool_parser.py::extract_tool_calls() (affected versions) did: 

def extract_tool_calls(self, model_output: str):
    try:
        data = eval(model_output, {}, {})
        return [(None, data["name"], data["parameters"])]
    except Exception:
        return [(model_output, None, None)]
eval(model_output, {}, {}) is not a sandbox — the globals={}/globals={} arguments do not restrict __import__ or attribute access. 4. Model output can be influenced by attacker prompts, so a response such as __import__('os').system('touch /tmp/hacked') executes in the server process. The primitive extends to reverse shells, malware download/execution, local secret reading, and lateral movement.

The fix (PR #4786, "fix: replace eval() with safe alternatives to prevent RCE in tool parsers") replaces eval() with safe parsing of the expected dict-shaped tool-call output.

Affected and patched versions

Product Affected Patched
Xinference (PyPI xinference / GitHub xorbitsai/inference) <= 2.5.0 2.7.0

Timeline: fix PR #4786 created 2026-04-10, merged 2026-04-14 (commit 1b3d220f342ce68d34cec4586d9409d457dadc42); PyPI 2.7.0 uploaded 2026-04-25. The GitHub Advisory Database entry (GHSA-x2rj-828p-hx9m / CVE-2026-61539) was published 2026-08-21, retroactively crediting the disclosure. Discovery credit per the advisory: XlabAI Team (Tencent Xuanwu Lab), Atuin Automated Vulnerability Discovery Engine, and Guannan Wang, Zhanpeng Liu, Guancheng Li.

Defender heuristics

  • Inventory inference hosts: find every host running xinference (container images, pip list, process listings, service ports). Any install <= 2.5.0 is RCE-eligible; upgrade to >= 2.7.0 and verify the resolved version.
  • Exposure check: confirm whether /v1/chat/completions (and other API endpoints) are reachable without authentication. The advisory's 10.0 score assumes no auth; if your deployment adds auth/network controls, residual risk is lower but the sink is still unsafe on old versions — patch anyway.
  • Prompt-provenance review: identify which models behind the API are Llama3-family (or any backend using the affected tool parsers), and which upstream traffic can shape their outputs (user-facing chat, RAG, agentic pipelines, forwarded requests from untrusted callers).
  • Host forensics on stale instances: look for anomalous children of the xinference process (shell, curl/wget, Python one-liners) and for artifacts consistent with post-exploitation (new crontabs, SSH keys, C2 connections) on hosts that were exposed and running <= 2.5.0 since April 2026.
  • Do not conflate with the supply-chain incident: xinference 2.6.0–2.6.2 were malicious releases (TeamPCP-attributed, yanked); CVE-2026-61539 is a code flaw fixed in 2.7.0. Both matter for any environment that ever ran that package; see the related page below.

Assessment limits

  • No in-the-wild exploitation, public exploit release, or actor attribution is reported as of the 2026-08-21 advisory publication.
  • The advisory details the Llama3 tool parser; other tool parsers shipped in the same releases may have had analogous patterns — the fix PR is described as replacing eval() with safe alternatives "in tool parsers" (plural). Treat 2.7.0 as the safe boundary rather than hunting parser-by-parser.
  • The tested configuration had authentication disabled; deployments with strong auth and network isolation had a smaller (but nonzero) attack surface.

Sources