{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xinference/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":10,"id":"CVE-2026-61539"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Xinference"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eXinference versions 2.5.0 and earlier contain a critical vulnerability, assigned CVE-2026-61539, stemming from the insecure use of Python's \u003ccode\u003eeval()\u003c/code\u003e function during tool-call parsing. The vulnerability exists within \u003ccode\u003exinference/model/llm/tool_parsers/llama3_tool_parser.py\u003c/code\u003e, where the application attempts to process outputs from LLMs into dictionary objects. Because the model output can be manipulated through prompt injection, an attacker can supply malicious Python expressions in their chat completion requests.\u003c/p\u003e\n\u003cp\u003eThe application, upon receiving a response from the model, passes the raw string output directly to \u003ccode\u003eeval()\u003c/code\u003e. In a default configuration where authentication is disabled, an unauthenticated attacker can interact with the \u003ccode\u003e/v1/chat/completions\u003c/code\u003e API to trigger this code execution. This allows for full compromise of the underlying server process, including unauthorized data access, system modification, or lateral movement within the network. Defenders must upgrade to a patched version immediately or ensure strict API authentication is enforced for all inference endpoints.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target running an unauthenticated Xinference instance (\u0026lt;= v2.5.0).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a prompt specifically designed to trigger tool-use capabilities in the target LLM.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a malicious Python payload (e.g., \u003ccode\u003e__import__('os').system(...)\u003c/code\u003e) within the prompt injection payload.\u003c/li\u003e\n\u003cli\u003eAttacker sends the crafted request to the \u003ccode\u003e/v1/chat/completions\u003c/code\u003e REST API endpoint.\u003c/li\u003e\n\u003cli\u003eThe model generates a completion containing the malicious Python expression intended to be interpreted as a tool call.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003exinference\u003c/code\u003e application's \u003ccode\u003eextract_tool_calls()\u003c/code\u003e function receives the model output and passes it to \u003ccode\u003eeval()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server process executes the malicious payload with the permissions of the Xinference service.\u003c/li\u003e\n\u003cli\u003eFinal objective: Remote code execution for full system compromise, exfiltration, or persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 score of 10.0, indicating total compromise of confidentiality, integrity, and availability. Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code within the host operating system. As Xinference is frequently deployed in environments hosting sensitive model data or interacting with internal infrastructure, the impact can extend to internal service discovery and lateral movement.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a version of Xinference beyond 2.5.0 that removes the use of \u003ccode\u003eeval()\u003c/code\u003e for tool-call parsing.\u003c/li\u003e\n\u003cli\u003eEnable mandatory authentication for all exposed API endpoints, specifically the \u003ccode\u003e/v1/chat/completions\u003c/code\u003e route, to prevent unauthenticated access.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to detect and block common shell injection patterns in request parameters targeting inference APIs.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected child processes being spawned from the Xinference server process (e.g., \u003ccode\u003e/bin/sh\u003c/code\u003e or \u003ccode\u003ecmd.exe\u003c/code\u003e spawned by the Python interpreter).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T01:16:40Z","date_published":"2026-08-22T01:16:40Z","id":"https://feed.craftedsignal.io/briefs/2026-08-xinference-rce/","summary":"Xinference is vulnerable to remote code execution due to the use of Python's unsafe eval() function to parse tool-call outputs generated by LLMs, allowing unauthenticated attackers to execute arbitrary code via prompt injection.","title":"Remote Code Execution in Xinference via Unsafe eval() in Tool-Call Parsing","url":"https://feed.craftedsignal.io/briefs/2026-08-xinference-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Xinference","version":"https://jsonfeed.org/version/1.1"}