Executive brief
Xinference is an open-source inference server that runs machine learning models. Before version 2.12.0, it unconditionally enabled remote code execution when loading models from Hugging Face, with no user-configurable setting to disable this risky behavior. An attacker with model launch access can register a malicious model that executes arbitrary Python code with the privileges of the Xinference worker process, potentially compromising the entire server and any data it handles.
Technical details
The vulnerability is a remote code execution flaw caused by unconditionally passing trust_remote_code=True when loading models via multiple code paths (tokenizer loading, embedding models, reranking models, and large language models). Six distinct loader sites in the codebase default this parameter to True without user control. An attacker with model launch permissions can register a model with an unknown type and supply an arbitrary model path; the server then calls AutoTokenizer.from_pretrained, which automatically imports and executes Python code defined in the model directory's tokenizer_config.json auto_map field. Version 2.12.0 fixes this by gating all loading sites behind an allow_trust_remote_code flag and XINFERENCE_TRUST_REMOTE_CODE environment variable, permitting remote code execution only for bundled built-in models. Exploitation requires valid model launch access to the Xinference server.
Affected products
- Xorbits AI Xinference before 2.12.0
Timeline
- 2026-08-24: disclosed
- 2026: patched: Fixed in version 2.12.0