Xinference EUVD-2026-64847

Exploitation requires a user account with model-launch (model registration) access on the Xinference server, consistent with CVSS PR:L - fully unauthenticated exploitation is not possible. The attacker must supply an arbitrary model path - either a local filesystem path reachable by the Xinference worker process, or a Hugging Face Hub model ID under attacker control - whose directory contains a crafted tokenizer_config.json with a malicious auto_map entry. No special non-default server configuration beyond allowing user-defined model registration is required; this is a standard Xinference deployment mode. Exploitation is limited by: (1) the requirement for authenticated model-launch access, ruling out anonymous internet-facing attacks; (2) the model path must be accessible to the worker process at load time, either via filesystem or network download; (3) deployments where only trusted administrators can register models reduce exploitability to an insider-threat scenario despite being technically vulnerable under the CVE scope.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 8.7) reflects network-accessible exploitation requiring only low-privilege authentication, with high impact on confidentiality, integrity, and availability of the vulnerable system - an accurate characterization of the attack surface. No EPSS score was provided, so quantitative exploitation probability cannot be assessed. The vulnerability is not listed in CISA KEV and no public exploit code was referenced in any intelligence source, which meaningfully reduces immediate mass-exploitation risk compared to a KEV-listed issue. Practical risk is moderate-to-high specifically for deployments that expose model registration to non-administrator users; deployments where only trusted operators can register models face substantially lower realized risk despite being technically vulnerable. The PR:L requirement prevents fully unauthenticated exploitation and limits automated scanning-style attacks, but does not protect against malicious insiders, compromised user accounts, or multi-tenant deployments. Attack complexity is low and no user interaction is required once the malicious model is registered, making exploitation straightforward for a credentialed attacker.

An attacker with a valid Xinference account and model-launch permission constructs a malicious directory containing a tokenizer_config.json with an auto_map entry that references an attacker-supplied Python file containing arbitrary OS commands or a reverse shell payload. The attacker registers this model via the Xinference API supplying the malicious directory as the model path, then triggers model loading; AutoTokenizer.from_pretrained unconditionally imports the attacker's Python module, executing the payload at the privilege level of the Xinference worker process. No public exploit code has been identified at time of analysis, but the mechanism is well-understood and the steps require only standard Hugging Face model format knowledge.