Executive brief
Xinference is a distributed inference framework that provides an OpenAI-compatible API for serving large language models. A critical flaw in the Llama3 tool-call parser uses Python's unsafe `eval()` function to process model output, allowing an unauthenticated remote attacker to inject malicious Python expressions through prompt injection and achieve arbitrary code execution on the server. The default deployment configuration does not require authentication, making this vulnerability trivially exploitable over the network.
Technical details
Xinference's Llama3 tool-call parser in `xinference/model/llm/tool_parsers/llama3_tool_parser.py` implements `extract_tool_calls()` using `eval(model_output, {}, {})` to convert model-generated dictionary-like strings into Python objects. The function is called during post-processing of tool-call results in the `/v1/chat/completions` endpoint when a `tools` parameter is present. An attacker can craft prompts that cause the LLM to return arbitrary Python expressions (e.g., `__import__('os').system('command')`), which are then executed in the Xinference server process context. The vulnerability requires network access to the chat completion API and no authentication in default configurations. Attack preconditions are minimal: only a crafted chat request with a `tools` field is needed. Fix: upgrade to version 2.7.0 or later, which replaces `eval()` with a safe JSON parser.
Affected products
- Xorbits AI Xinference <= 2.5.0
Timeline
- 2026-07-13: disclosed: Initially published in GitHub Advisory Database
- 2026-08-21: advisory: Updated with final severity and CVE assignment
- 2026-07-13: patched: Fix released in version 2.7.0