# CVE-2026-76841: Xinference remote code execution via Hugging Face trust_remote_code

Source: https://junglewise.ai/threats/cve-2026-76841-xinference-remote-code-execution-via-hugging-face-trust-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76841 · Severity: high · CVSS 8.8 · Published 2026-08-24

Xinference is an open-source inference server that runs machine learning models. Before version 2.12.0, it unconditionally enabled remote code execution when loading models from Hugging Face, with no user-configurable setting to disable this risky behavior. An attacker with model launch access can register a malicious model that executes arbitrary Python code with the privileges of the Xinference worker process, potentially compromising the entire server and any data it handles.

## Quick answers

**Is CVE-2026-76841 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76841 being exploited in the wild.

**How severe is CVE-2026-76841?** High severity, with a CVSS score of 8.8, published 24 August 2026.

**Which products and versions are affected?** Xorbits AI Xinference before 2.12.0.

**Is there a fix for CVE-2026-76841?** A patch was published on 2026: Fixed in version 2.12.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76841 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76841?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a remote code execution flaw caused by unconditionally passing trust_remote_code=True when loading models via multiple code paths (tokenizer loading, embedding models, reranking models, and large language models). Six distinct loader sites in the codebase default this parameter to True without user control. An attacker with model launch permissions can register a model with an unknown type and supply an arbitrary model path; the server then calls AutoTokenizer.from_pretrained, which automatically imports and executes Python code defined in the model directory's tokenizer_config.json auto_map field. Version 2.12.0 fixes this by gating all loading sites behind an allow_trust_remote_code flag and XINFERENCE_TRUST_REMOTE_CODE environment variable, permitting remote code execution only for bundled built-in models. Exploitation requires valid model launch access to the Xinference server.

## Affected products

- Xorbits AI Xinference before 2.12.0

## Timeline

- 2026-08-24: disclosed
- 2026: patched: Fixed in version 2.12.0

## References

- [https://pypi.org/project/xinference/](https://pypi.org/project/xinference/)
- [https://github.com/xorbitsai/inference](https://github.com/xorbitsai/inference)