CVE-2026-76841

Name of the Vulnerable Software and Affected Versions Xinference versions prior to 2.12.0

Description Xinference unconditionally enables Hugging Face remote code execution during model loading. This occurs because six loader call sites pass trust remote code=True as a literal or unconditional default. The affected functions include RerankModel. get tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and both PytorchModel. sanitize model config and PytorchModel. get components in xinference/model/llm/transformers/core.py.

A user with model launch access can register a model of an unknown type and provide an arbitrary model path. This triggers the auto detect type process and subsequently AutoTokenizer.from pretrained, which imports and executes Python code defined in the auto map of the model directory's tokenizer config.json file. This allows the execution of attacker-supplied code with the privileges of the worker process.

Recommendations Update to version 2.12.0 or later to ensure all remote code execution sites are gated behind the allow trust remote code parameter and the XINFERENCE TRUST REMOTE CODE setting.