Xorbitsai
Monthly
Unauthenticated arbitrary-path file read in Xinference v3.x (including commit 4a94832 and v3.3.0) exposes server filesystem content to any network-accessible attacker via the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path without authentication or path validation, reads config.json, tokenizer_config.json, and chat_template.jinja from that path, and reflects the parsed content in the HTTP response. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-prerequisite network attack makes any internet-exposed Xinference instance immediately at risk.
Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary-path file read in Xinference v3.x (including commit 4a94832 and v3.3.0) exposes server filesystem content to any network-accessible attacker via the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path without authentication or path validation, reads config.json, tokenizer_config.json, and chat_template.jinja from that path, and reflects the parsed content in the HTTP response. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-prerequisite network attack makes any internet-exposed Xinference instance immediately at risk.
Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.