Xinference: Unauthenticated RCE via eval() in Llama3 Tool-Call Parser (CVE-2026-61539, CVSS 10.0)

A critical, unauthenticated remote code execution vulnerability has been disclosed in Xinference, a popular open-source model-serving framework, and tracked as CVE-2026-61539 (CVSS v3.1: 10.0).

What happened

According to the GitHub Security Advisory (GHSA-x2rj-828p-hx9m), Xinference's Llama3 tool-call parser (xinference/model/llm/tool_parsers/llama3_tool_parser.py) used Python's eval() to convert model-generated tool-call output into a dictionary via extract_tool_calls(). Because the text passed to eval() originates from the LLM's own output — which can in turn be steered by attacker-controlled input to the /v1/chat/completions endpoint — a remote party can craft a prompt that causes the model to emit a Python expression such as __import__('os').system(...). When that expression reaches eval(model_output, {}, {}), it executes on the Xinference server. The advisory notes that in the tested default deployment, authentication was not enabled, making this exploitable without credentials. A public PoC is reported to exist.

Why it matters

Xinference is used to self-host and serve open-source LLMs behind an OpenAI-compatible API. Because the flaw sits in server-side post-processing of model output rather than in a specific prompt-injection payload format, it affects any deployment using the Transformers backend with the Llama3 tool-call parser and the tools parameter enabled. Given no-auth-by-default test conditions and full C:H/I:H/A:H impact, a reachable Xinference instance could allow complete server compromise, credential theft, or lateral movement — a serious risk for organizations that have exposed inference endpoints to the internet or to less-trusted internal networks.

What defenders should watch for now

• Inventory any self-hosted Xinference deployments and confirm whether the Llama3 tool-call parser and tools/function-calling features are enabled.
• Verify authentication is enforced in front of /v1/chat/completions and any other Xinference API surface — do not rely on default configuration.
• Restrict network exposure of inference endpoints (internal-only access, allow-listing, API gateway/auth proxy) until patched.
• Monitor Xinference server process activity for unexpected child processes, outbound connections, or file writes originating from the serving process — signs of a successful eval()-based command execution.
• Review logs of chat-completion requests for anomalous tool-call-shaped payloads or prompts attempting to coerce structured/code-like output.
• Apply the vendor's patched release as soon as it is available and confirm the parser no longer relies on eval().

Developing intel

This is based on a same-day GitHub Security Advisory; full patch details, affected version ranges, and broader exploitation activity may still be evolving. Review the original advisory for authoritative technical detail and remediation guidance: GHSA-x2rj-828p-hx9m.