Tracking: CVE-2026-61539
Severity: Critical (CVSS 3.1: 10.0)
Who is affected
The advisory lists xinference through 2.5.0 as affected and 2.7.0 as the first patched release. The demonstrated path uses non-streaming chat completions with tools, the Transformers backend, and the Llama3 tool parser.
How the attack works
Attacker-controlled prompts can influence tool-call output returned through /v1/chat/completions. The parser calls Python eval() on that output. Empty dictionaries passed to eval() do not establish a safe sandbox.
The result can be arbitrary Python execution on the inference host. The tested default deployment had authentication disabled, so the demonstrated caller did not need credentials. Deployments with authentication still need to assess who can submit requests to the affected parsing path.
What to do
- Upgrade to 2.7.0 or later and verify the running inference workers use the patched code.
- Until patched, restrict the affected endpoint and avoid the vulnerable tool-parsing configuration.
- Review requests and host activity around suspicious tool output. Limit inference-worker access to model storage, credentials, and internal services.
Scope and limits
The published metadata does not establish the status of every intermediate release. Use the identified patched version rather than inferring safety from an unlisted version.