xorbitsai inference

• CVE-2026-112051 Medium 6.5 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration 0.4%
• CVE-2026-85668 High 7.5 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register 0.6%
• CVE-2026-76841 High 8.8 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders 1.0%
• CVE-2026-61539 Critical 10.0 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing 1.2%