CVE-2026-61539

Received Received - Intake

Code Execution in Xinference via Llama3 Tool-Call Output

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-61539

EUVD

EUVD-2026-64146

Affected Vendors & Products

Vendor	Product	Version / Range
xinference	xinference	to 2.7.0 (exc)
xinference	xinference	2.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

Xinference versions 2.5.0 and earlier have a code injection vulnerability where attacker-controlled output from Llama3 tool calls is passed to Python's eval() function. This occurs in specific parser files during chat completion processing. An unauthenticated remote attacker can craft prompts to manipulate this output and execute arbitrary commands on the server.

Detection Guidance

This vulnerability involves command injection via eval() in Llama3 tool-call output. To detect it, monitor for unusual process activity or network connections from the Xinference server process. Check logs in /var/log/ or application-specific logs for suspicious chat/completions requests with tools fields. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows complete server compromise. Attackers could steal sensitive data, install malware, modify system files, or use the server as a pivot point to attack other systems. The high CVSS score (10.0) indicates maximum impact potential including confidentiality, integrity, and availability breaches.

Compliance Impact

This vulnerability would likely violate GDPR's security requirements (Article 32) and HIPAA's Security Rule due to inadequate protection against unauthorized access. Organizations using affected versions would face compliance violations, potential fines, and mandatory breach notifications if exploited.

Mitigation Strategies

Upgrade Xinference to version 2.7.0 or later immediately to patch the vulnerability. If upgrading is not possible, restrict network access to the Xinference API endpoints and disable the /v1/chat/completions endpoint if not required. Monitor for any signs of exploitation.

Hi! I’m here to help you understand CVE-2026-61539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70