{"id":"CVE-2026-61539","title":"Xinference is an inference API for running open-source, speech, and multimodal models","summary":"Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-95"],"vendor":"xinference","product":"xinference","affected":["xinference < 2.7.0"],"patched":["xinference 2.7.0"],"published":"2026-08-21","updated":"2026-10-12","sourceUpdated":"2026-10-12T16:10:00.220","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61539","references":[{"url":"https://github.com/xorbitsai/inference/commit/1b3d220f342ce68d34cec4586d9409d457dadc42","label":"security-advisories@github.com"},{"url":"https://github.com/xorbitsai/inference/pull/4786","label":"security-advisories@github.com"},{"url":"https://github.com/xorbitsai/inference/releases/tag/v2.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/xorbitsai/inference/security/advisories/GHSA-x2rj-828p-hx9m","label":"security-advisories@github.com"},{"url":"https://github.com/xorbitsai/inference"},{"url":"https://pypi.org/project/xinference"},{"url":"https://github.com/advisories/GHSA-x2rj-828p-hx9m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61539"}],"tags":["nvd","osv","pip","ghsa"],"epss":0.01226,"epssPercentile":0.68675,"aliases":["GHSA-x2rj-828p-hx9m","PYSEC-2026-3946"],"ecosystem":"pip","ingestedAt":"2026-08-21T21:22:19.508Z","slug":"CVE-2026-61539","body":"## Overview\n\nXinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61539)\n\nAffected packages:\n\n- `xinference < 2.7.0`\n\nPatched in:\n\n- `xinference 2.7.0`\n\nSource: https://osv.dev/vulnerability/GHSA-x2rj-828p-hx9m","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}