Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck
CVE-2026-76841Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders
High 8.8
In plain English
A high-severity code injection in inference from xorbitsai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Official description
Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._get_tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence_transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence_transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches _auto_detect_type and then AutoTokenizer.from_pretrained, which imports and executes Python declared by the model directory's own tokenizer_config.json auto_map, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code only for bundled built-in models.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/xorbitsai/inference product
- https://github.com/xorbitsai/inference/issues/5023 issue-tracking
- https://github.com/xorbitsai/inference/pull/5027 issue-tracking, patch
- https://github.com/xorbitsai/inference/blob/v2.11.0/xinference/model/rerank/core.py technical-description
- VulnCheck Advisory: Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders third-party-advisory