CVE-2026-61539 Xorbits AI CVE debrief

Who should care

Organizations using Xinference API version 2.5.0 or earlier should prioritize remediation. Specifically, those in industries relying heavily on AI and machine learning inference, such as speech and multimodal model applications, should assess their exposure and apply necessary patches or compensating controls.

Technical summary

The CVE-2026-61539 vulnerability in Xinference, an inference API for running open-source models, allows unauthenticated remote attackers to execute commands in the server process context. This issue arises from the API's handling of Llama3 tool-call output in versions 2.5.0 and earlier, where attacker-influenced output is passed to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py.

Defensive priority

Critical vulnerability in Xinference, an inference API for running open-source models, allows unauthenticated remote attackers to execute commands in the server process context.

Recommended defensive actions

• Inventory and assess exposure to Xinference API version 2.5.0 or earlier.
• Apply version 2.7.0 or later to address the vulnerability.
• Implement compensating controls, such as monitoring and exception tracking, until remediation can be applied.
• Restrict access to the Xinference API to trusted sources only.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-61539 issue arises from Xinference's handling of Llama3 tool-call output in versions 2.5.0 and earlier. Specifically, the xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py files pass attacker-influenced output to eval(). This occurs when requests to /v1/chat/completions with a tools field are processed through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression.

Official resources