Description

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._get_tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence_transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence_transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches _auto_detect_type and then AutoTokenizer.from_pretrained, which imports and executes Python declared by the model directory's own tokenizer_config.json auto_map, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code only for bundled built-in models.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-24T14:17:01.760Z",
  "pubdate": "2026-08-24T14:17:01.760Z",
  "executiveSummary": "Xinference contains an arbitrary remote code execution vulnerability stemming from the unconditional enablement and passing of the trust_remote_code=True parameter across multiple Hugging Face model loader call sites prior to version 2.12.0.\nAn authenticated or unauthenticated attacker with model launch access can leverage this flaw by registering a model with an unknown type and supplying an arbitrary model path, forcing the application to execute attacker-supplied Python code.\nThis execution occurs within the context of the worker process, leading to a complete compromise of the underlying system hosting the vulnerable Xinference instance.\nThe affected products include Xinference versions prior to 2.12.0 across multiple loader implementations.\nExploitation requires the capability to launch or register models within the Xinference environment, which then abuses the automatic loading mechanisms of the transformers and tokenizers libraries.\nRisk implications are severe, as arbitrary code execution allows attackers to pivot internally, exfiltrate sensitive data, or disrupt service availability.",
  "technicalDetails": "The root cause of the vulnerability lies in the hardcoded or unconditionally defaulted usage of trust_remote_code=True across six distinct model loader call sites within the codebase.\nSpecifically, these vulnerable sites comprise RerankModel._get_tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence_transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence_transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two separate sites within xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components enforce this setting.\nPrior to version 2.12.0, Xinference exposed no administrative controls or settings to disable this behavior, forcing the framework to trust and load custom model definitions unconditionally.\nThe attack flow initiates when an attacker with model launch access registers a model with an unrecognized or arbitrary model type, providing a malicious model path or repository.\nUpon processing this registration, the server invokes _auto_detect_type followed by AutoTokenizer.from_pretrained and associated loading routines.\nBecause trust_remote_code=True is active, the underlying Hugging Face libraries automatically import and execute arbitrary Python code declared inside the model directory's tokenizer_config.json via the auto_map configuration.\nThis behavior results in the execution of attacker-supplied payloads directly within the privileges of the worker process handling the model load.\nThe vulnerability affects Xinference versions prior to 2.12.0 and requires network exposure to the model launch or registration endpoints."
}