CVE-2026-61539: Xinference: remote code execution via unsafe eval() in Llama3 tool-call parsing
CVE-2026-61539 is a critical eval injection flaw (CWE-95) in Xinference, an inference API for open-source, speech and multimodal models. According to the record, model-generated Llama3 tool-call output can reach eval() on the server, which may allow command execution in the Xinference process context. The issue is fixed in version 2.7.0, and the record shows no confirmed exploitation in CISA KEV.
Overview
CVE-2026-61539 affects Xinference, an inference API for running open-source, speech and multimodal models. According to the record, output from Llama3 tool-call parsing is passed to eval(), so a model-generated Python expression can be evaluated by the server. The weakness is classified as CWE-95 (Eval Injection).
Impact
- The record states that an unauthenticated remote attacker can influence the model output through a crafted prompt and execute commands in the Xinference server process context.
- The CVSS base score is 10 (critical). The vector indicates a network attack vector, low complexity, no privileges required, no user interaction, a changed scope, and high impact on confidentiality, integrity and availability.
- Because the impact is on the server process, the consequences could extend beyond the inference API itself. The record does not describe the specific consequences in detail.
Affected products and versions
- Product: Xorbitsai Inference (Xinference).
- The description says versions 2.5.0 and earlier are affected. The structured affected range is recorded as before 2.7.0.
- The fixed version is 2.7.0.
- The sources do not state whether versions between 2.5.0 and 2.7.0 are affected. This is unknown from the record.
Exploitation status
- The record shows that this CVE is not listed in CISA KEV.
- The SSVC exploitation field is recorded as none.
- The EPSS probability is 0.01226 with a percentile of 0.68624, dated 2026-10-23.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade Xinference to version 2.7.0 or later, which the record identifies as the fixed release.
- Review the upstream GitHub security advisory and the release notes for 2.7.0.
- Until the upgrade is applied, limit network exposure of the inference API and restrict access to trusted, authenticated clients.
- Treat deployments that serve untrusted users or accept tool-enabled chat requests from external sources as higher priority.
Detection guidance
- Review application and server logs for chat requests that include tool-related fields from unexpected sources.
- Monitor the Xinference server process for unexpected child processes, outbound connections or file changes.
- Compare running versions against the fixed release to identify unpatched hosts.
Limitations of the available information
- The fixed version 2.7.0 is confirmed by the record, but the fixes list in the record is empty.
- The record does not provide proof-of-concept details, and this analysis does not include exploitation steps.
- It is unknown whether other parsers or model types in Xinference are affected beyond the Llama3 tool-call path.
- The record shows a difference between the description (2.5.0 and earlier) and the structured range (before 2.7.0). The exact boundary should be verified against the upstream advisory.
Frequently asked questions
Which Xinference versions are affected by CVE-2026-61539?
The description states that version 2.5.0 and earlier are affected, and the structured range is before 2.7.0. Versions between 2.5.0 and 2.7.0 are not clearly addressed in the record.
What is the fixed version?
The record identifies version 2.7.0 as the fix. Upgrading to 2.7.0 or later is the recommended remediation.
Is this vulnerability being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.