PT-2026-80328 · Pypi · Xinference

Publicado

2026-08-21

·

Atualizado

2026-08-21

CVSS v3.1

10

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

Xinference used Python's unsafe eval() function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to return a Python expression. Xinference then evaluates that expression on the server while post-processing the tool-call result. In the tested default deployment, authentication was not enabled, so the vulnerability was exploitable by an unauthenticated remote attacker through the /v1/chat/completions endpoint.

Details

Users can interact with deployed models through Xinference's OpenAI-compatible /v1/chat/completions API. The request entry point is implemented in xinference/api/restful api.py; non-streaming requests call the model instance's chat() method and return the inference result.
When the Transformers backend is used, inference results flow through the batching logic in xinference/model/llm/transformers/core.py. Non-streaming chat results are handled by handle chat result non streaming(). If the request contains a tools field, Xinference calls post process completion() to parse tool-call output from the model response.
The Llama3 tool-call parser is implemented in xinference/model/llm/tool parsers/llama3 tool parser.py. In affected versions, extract tool calls() parsed model output with eval():
python
def extract tool calls(
  self, model output: str
) -> List[Tuple[Optional[str], Optional[str], Optional[Dict[str, Any]]]]:
  try:
    data = eval(model output, {}, {})
    return [(None, data["name"], data["parameters"])]
  except Exception:
    return [(model output, None, None)]
The intended behavior was to convert a Python dictionary-like string generated by the model into a dictionary object. However, eval() executes the input as a Python expression, and eval(model output, {}, {}) is not a security sandbox. If an attacker can influence the model output through prompt injection or direct chat input, the attacker can cause the model to return an expression such as:
python
 import ('os').system('touch /tmp/hacked')
When the expression reaches eval(), it is executed in the Xinference server process context. The harmless touch /tmp/hacked command can be replaced with other payloads, such as a reverse shell, malware download, sensitive file read, or lateral-movement payload.

Score

Severity: Critical
CVSS v3.1: 10.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Rationale:
  • AV:N: the vulnerable API is remotely reachable over the network;
  • AC:L: exploitation only requires a crafted chat-completion request and tool-call parameter;
  • PR:N: the tested default configuration did not require authentication;
  • UI:N: no user interaction is required;
  • S:C: command execution can affect resources beyond the Xinference application boundary;
  • C:H/I:H/A:H: remote code execution can fully compromise confidentiality, integrity, and availability.

Credit

This vulnerability was discovered by:

Correção

Eval Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-95

Identificadores relacionados

GHSA-X2RJ-828P-HX9M

Produtos afetados

Xinference