CVE-2026-76841 in inference
Summary
by MITRE • 08/24/2026
Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._get_tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence_transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence_transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches _auto_detect_type and then AutoTokenizer.from_pretrained, which imports and executes Python declared by the model directory's own tokenizer_config.json auto_map, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code only for bundled built-in models.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability in Xinference prior to version 2.12.0 represents a critical server-side request forgery and arbitrary code execution flaw rooted in the unconditional enabling of Hugging Face's trust_remote_code feature during model loading operations. This security deficiency allows an attacker with access to launch or register models within the Xinference environment to execute malicious Python code on the host system with the privileges of the worker process. The core issue lies in how the framework interacts with external repositories, specifically by bypassing safety checks that are designed to prevent the execution of untrusted scripts embedded within model configurations.
Technically, the flaw manifests across multiple loader call sites within the Xinference architecture, including RerankModel._get_tokenizer, SentenceTransformerRerankModel.load, SentenceTransformerEmbeddingModel.load, FlagEmbeddingModel.load, and two distinct locations in PytorchModel for LLM handling via transformers/core.py. In each of these instances, the parameter trust_remote_code is either passed as a literal True value or set as an unconditional default. When a user registers a model with an unknown type and provides an arbitrary path to a Hugging Face repository, the server invokes _auto_detect_type followed by AutoTokenizer.from_pretrained. This function reads the tokenizer_config.json file from the specified repository, which may contain an auto_map entry pointing to custom Python code. Because trust_remote_code is enabled without restriction, this external code is imported and executed immediately during the loading phase, granting the attacker full control over the execution environment of the Xinference worker process.
The operational impact of this vulnerability is severe, as it effectively provides a remote code execution vector for any authenticated user or service account capable of initiating model loads within the system. An adversary can craft a malicious Hugging Face repository containing poisoned configuration files that trigger arbitrary command execution on the server hosting Xinference. This could lead to complete compromise of the underlying infrastructure, including data exfiltration, lateral movement across internal networks, and persistence mechanisms established through the compromised worker process. The lack of any configurable setting in versions prior to 2.12.0 means there was no mitigation available for administrators relying on this software stack, leaving all deployments vulnerable to exploitation by anyone with model registration privileges.
This vulnerability aligns closely with CWE-94 Improper Control of Generation of Code and is classified under the ATT&CK technique T1059 Command and Scripting Interpreter, specifically involving Python code execution via remote inputs. The failure to validate or restrict external code execution based on source trustworthiness violates fundamental security principles regarding input validation and secure configuration management. It highlights the risks associated with integrating third-party model repositories without implementing strict sandboxing or verification protocols for dynamic code loading features.
To mitigate this risk, organizations must upgrade immediately to Xinference version 2.12.0 or later, which introduces proper gating mechanisms for remote code execution. In these updated versions, every loader site is secured behind the allow_trust_remote_code flag and the XINFERENCE_TRUST_REMOTE_CODE environment variable. This ensures that trust_remote_code defaults to False unless explicitly enabled by an administrator, thereby restricting arbitrary code execution exclusively to bundled built-in models where the source code has been vetted for safety. Administrators should also audit their deployment configurations to ensure no legacy settings override these new safeguards and consider implementing network-level controls to restrict outbound connections from worker processes to external model repositories whenever possible.