Description

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-21T21:17:00.867Z",
  "pubdate": "2026-08-21T21:17:00.867Z",
  "executiveSummary": "An arbitrary code execution vulnerability exists in Xinference version 2.5.0 and earlier, stemming from the unsafe evaluation of attacker-influenced model-generated outputs. The flaw resides in the handling of Llama3 tool-call outputs where dynamic Python expressions are passed to the builtin eval() function.\nAn unauthenticated remote attacker can leverage this vulnerability by sending a crafted prompt to the /v1/chat/completions endpoint containing a tools field. Through prompt manipulation, the attacker can influence the model's tool-call generation, causing the Xinference server to execute arbitrary Python code within the process context of the running server.\nThe impact of successful exploitation includes complete remote code execution under the privileges of the Xinference server process, potentially leading to unauthorized system access, data exfiltration, or complete compromise of the host infrastructure. Exploitation requires network access to the exposed API endpoint and the ability to submit crafted chat completion requests.",
  "technicalDetails": "The vulnerability is caused by the insecure deserialization and execution of untrusted data via the Python eval() function. Specifically, attacker-influenced Llama3 tool-call outputs are directly evaluated without proper sanitization or sandboxing.\nThe vulnerable components include xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py, which contain the vulnerable evaluation routines extract_tool_calls() and _eval_llama3_chat_arguments().\nThe complete attack flow begins when an unauthenticated remote attacker sends an HTTP POST request to the /v1/chat/completions endpoint with a maliciously crafted tools field. The request is processed through xinference/api/restful_api.py, flows into xinference/model/llm/transformers/core.py, and proceeds through handle_chat_result_non_streaming() and _post_process_completion().\nDuring post-processing, the model-generated Python expression derived from the crafted prompt is processed and passed directly to eval() by the Llama3 tool parsing logic. Because the input is influenced by the attacker's prompt, the embedded payload is dynamically executed by the Python interpreter.\nThe execution occurs within the security context of the Xinference server process, requiring no prior authentication or elevated privileges from the attacker, provided network connectivity to the API is established."
}