CVE-2026-61539: Xinference LLM Tool Parser RCE Vulnerability

CVE-2026-61539 Overview

Xinference is an inference API for running open-source large language, speech, and multimodal models. CVE-2026-61539 is a code injection vulnerability [CWE-95] in Xinference versions 2.5.0 and earlier. The server passes attacker-influenced Llama3 tool-call output directly to Python eval() inside xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. An unauthenticated remote attacker can craft a prompt that steers model output into executable Python, achieving arbitrary command execution in the Xinference server process context. The issue is fixed in version 2.7.0.

Critical Impact
Unauthenticated remote code execution against the Xinference server via a crafted prompt to /v1/chat/completions, giving attackers control of the inference host and any model data or credentials it holds.

Affected Products

Xinference (xorbitsai/inference) versions 2.5.0 and earlier
The llama3_tool_parser.py tool-call parser component
The utils.py helper used by _eval_llama3_chat_arguments()

Discovery Timeline

2026-08-21 - CVE-2026-61539 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-61539

Vulnerability Analysis

The vulnerability sits in Xinference's Llama3 tool-call handling pipeline. Requests to /v1/chat/completions that include a tools field flow through xinference/api/restful_api.py, then xinference/model/llm/transformers/core.py, then handle_chat_result_non_streaming(), and finally _post_process_completion(). At the end of that chain, extract_tool_calls() and _eval_llama3_chat_arguments() call Python eval() on the model-generated expression representing tool arguments.

Because the model's output is derived from the user's prompt, an attacker can steer the model into producing a Python expression that performs arbitrary operations when evaluated. Successful exploitation runs code with the privileges of the Xinference server process, which typically has access to loaded models, API keys, and local network resources.

Root Cause

The root cause is unsafe evaluation of untrusted input [CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code]. The tool parser used eval() to convert a string representation of tool arguments into Python objects, instead of using a safe parser such as ast.literal_eval() or json.loads(). Any content that reaches the parser is executed as Python code, regardless of source.

Attack Vector

The attack is network-based, unauthenticated, and requires no user interaction. An attacker sends a chat completion request with a tools field and a prompt engineered to induce Llama3 to emit a Python expression containing side-effecting code, for example a call to __import__('os').system(...). When the server post-processes the model output, eval() executes the payload.

python

# Patch excerpt from xinference/model/llm/tool_parsers/llama3_tool_parser.py
+import ast
+import json
 import logging
 from typing import Any, Dict, List, Optional, Tuple

# Patch excerpt from xinference/model/llm/utils.py
+import ast
 import base64
 import functools
 import json

Source: GitHub commit 1b3d220. The fix replaces eval() with ast.literal_eval() and json.loads(), which parse literals and JSON without executing code.

Detection Methods for CVE-2026-61539

Indicators of Compromise

Child processes spawned by the Xinference Python process, particularly shells (/bin/sh, bash, cmd.exe) or interpreters not required for inference.
Outbound network connections initiated by the Xinference process to unexpected hosts, including reverse-shell destinations.
Chat completion request bodies containing tools fields where model-facing prompts include Python builtins such as __import__, eval, exec, os.system, or subprocess.
Unexpected file writes under the Xinference working directory, model cache, or /tmp.

Detection Strategies

Alert on process-tree anomalies where the Xinference server parent spawns shell interpreters or scripting binaries.
Inspect HTTP request bodies to /v1/chat/completions for prompts that reference Python code constructs or tool-call payloads with executable syntax.
Monitor for new listening sockets or reverse connections from the host running Xinference.

Monitoring Recommendations

Enable verbose logging of tool-call parsing and record the raw model output before evaluation for forensic review.
Forward host telemetry (process, file, network) from inference servers to a centralized analytics platform for behavioral correlation.
Track version strings of deployed Xinference instances and alert when any host reports a version at or below 2.5.0.

How to Mitigate CVE-2026-61539

Immediate Actions Required

Upgrade Xinference to version 2.7.0 or later, which replaces eval() with ast.literal_eval() and json.loads() in the affected tool parsers.
Restrict network exposure of the Xinference API so that only trusted clients can reach /v1/chat/completions.
Run the Xinference process as a non-privileged user in an isolated container or namespace to limit blast radius.
Rotate any credentials, API keys, or model tokens accessible to the Xinference process if exposure to untrusted callers occurred before patching.

Patch Information

The fix is available in Xinference v2.7.0. See the GitHub Security Advisory GHSA-x2rj-828p-hx9m, the pull request #4786, and the v2.7.0 release notes for full details.

Workarounds

Disable Llama3 tool-calling functionality by rejecting requests that include a tools field until the upgrade is applied.
Place an authenticating reverse proxy in front of Xinference and block anonymous access to chat completion endpoints.
Apply an egress firewall policy to the inference host to prevent outbound connections initiated by exploitation payloads.

bash

# Example: pin Xinference to the patched release
pip install --upgrade "xinference>=2.7.0"

# Example: verify the installed version before returning the service to production
python -c "import xinference; print(xinference.__version__)"