xinference vulnerabilities
CVEs whose affected-version data names the xinference package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-76841High· 8.8Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it
Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional de…
▾ Twilightxorbitsai · xinferenceEPSS 1.0%via NVD
CVE-2026-61539Critical· 10.0Xinference is an inference API for running open-source, speech, and multimodal models
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.…
▾ Midnightxinference · xinferenceEPSS 1.2%via NVD