Remote Code Execution in Xinference via Unsafe eval() in Tool-Call Parsing

Xinference versions 2.5.0 and earlier contain a critical vulnerability, assigned CVE-2026-61539, stemming from the insecure use of Python's eval() function during tool-call parsing. The vulnerability exists within xinference/model/llm/tool_parsers/llama3_tool_parser.py, where the application attempts to process outputs from LLMs into dictionary objects. Because the model output can be manipulated through prompt injection, an attacker can supply malicious Python expressions in their chat completion requests.

The application, upon receiving a response from the model, passes the raw string output directly to eval(). In a default configuration where authentication is disabled, an unauthenticated attacker can interact with the /v1/chat/completions API to trigger this code execution. This allows for full compromise of the underlying server process, including unauthorized data access, system modification, or lateral movement within the network. Defenders must upgrade to a patched version immediately or ensure strict API authentication is enforced for all inference endpoints.

Attack Chain

1. Attacker identifies a target running an unauthenticated Xinference instance (<= v2.5.0).
2. Attacker crafts a prompt specifically designed to trigger tool-use capabilities in the target LLM.
3. Attacker embeds a malicious Python payload (e.g., __import__('os').system(...)) within the prompt injection payload.
4. Attacker sends the crafted request to the /v1/chat/completions REST API endpoint.
5. The model generates a completion containing the malicious Python expression intended to be interpreted as a tool call.
6. The xinference application's extract_tool_calls() function receives the model output and passes it to eval().
7. The server process executes the malicious payload with the permissions of the Xinference service.
8. Final objective: Remote code execution for full system compromise, exfiltration, or persistence.

Impact

The vulnerability carries a CVSS v3.1 score of 10.0, indicating total compromise of confidentiality, integrity, and availability. Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code within the host operating system. As Xinference is frequently deployed in environments hosting sensitive model data or interacting with internal infrastructure, the impact can extend to internal service discovery and lateral movement.

Recommendation

• Upgrade to a version of Xinference beyond 2.5.0 that removes the use of eval() for tool-call parsing.
• Enable mandatory authentication for all exposed API endpoints, specifically the /v1/chat/completions route, to prevent unauthenticated access.
• Deploy web application firewall (WAF) rules to detect and block common shell injection patterns in request parameters targeting inference APIs.
• Monitor for unexpected child processes being spawned from the Xinference server process (e.g., /bin/sh or cmd.exe spawned by the Python interpreter).