This implementation allows an attacker with model launch access to register a custom model type and supply a malicious model path. During the model loading sequence, the server invokes 'AutoTokenizer.from_pretrained'. If an attacker provides a 'tokenizer_config.json' file containing an 'auto_map' entry, the server will automatically import and execute arbitrary Python code defined within the model directory. This code executes with the full privileges of the Xinference worker process. Version 2.12.0 mitigates this issue by introducing the 'XINFERENCE_TRUST_REMOTE_CODE' setting and requiring explicit enablement to permit remote code execution for non-bundled models.

Impact

An attacker exploiting this vulnerability achieves remote code execution in the context of the worker process. This can lead to full compromise of the hosting server, sensitive data exfiltration, or lateral movement within the environment. This vulnerability affects any deployment of Xinference prior to version 2.12.0 that allows untrusted users to launch or register new model paths.

Recommendation

• Immediately upgrade all instances of Xinference to version 2.12.0 or later to ensure the 'trust_remote_code' functionality is gated by configuration.
• Audit current model registration logs for the registration of arbitrary model paths or custom model types by unauthorized users.
• Restrict model registration and launch capabilities to trusted administrators or authenticated service identities within the infrastructure.