CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing
An unauthenticated remote attacker can execute arbitrary code on the Xinference server by crafting prompts that trigger unsafe eval() in Llama3 tool-call parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61539?
CVE-2026-61539 is a critical code injection vulnerability in xorbitsai inference, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.
Weakness: CWE-95
Which versions are affected by CVE-2026-61539?
3 open source packages ship an affected version, including xinference.
| Package | Affected | Fixed in |
|---|---|---|
xinference PyPI | All versions | 2.7.0 |
xinference PyPI | All versions | 2.7.0 |
xinference PyPI | All versions | 2.7.0 |
How do I fix CVE-2026-61539?
Upgrade xinference to 2.7.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-61539 being exploited?
There is no known exploitation of CVE-2026-61539 in the wild and no public exploit code.
Sources
Also known as GHSA-x2rj-828p-hx9m, PYSEC-2026-3946.