Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always on

Impact

Six loader call sites in Xinference pass trust_remote_code=True unconditionally, and before 2.12.0 there is no setting to turn it off. Anyone who can call the model-launch API can register a model of unknown type pointing at an arbitrary model path; the server falls through to AutoTokenizer.from_pretrained, which imports and runs Python named by that directory's tokenizer_config.json auto_map. The code runs as the Xinference worker process, which on a GPU node is normally a long-lived process holding the GPU, the model cache and any registry or object-store credentials the fleet gave it. On a shared inference cluster this turns a low-privilege serving account into code execution on every worker that picks up the launch request.

Who can reach it

Any authenticated user with model-launch access to the Xinference API, including a tenant on a shared inference endpoint. No admin role and no host access needed - supplying a model path is enough.

What to do

Upgrade to Xinference 2.12.0 or later, where every loader is gated behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting and remote code is permitted only for bundled built-in models. Restart the supervisor and every worker after upgrading; the GPUs are released and reloaded, so models must be re-warmed but nodes do not need rebooting. Until then, restrict who can reach the launch API and do not accept tenant-supplied model paths.

References

Related entries

• Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
• Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High
• Axolotl: multipack patch loads Hugging Face base models with trust_remote_code=True, giving RCE on the training nodeCVE-2026-86169 · Axolotl (multipack patch path, trust_remote_code guard)High
• vLLM: rejected requests leak decode-worker metadata until the worker exhausts memoryCVE-2026-93436 · vLLM NIXL KV connector (decode-side metadata cleanup for rejected requests)High
• vLLM: negative token IDs in embeddings requests poison the CUDA context and wedge the engineCVE-2026-93592 · vLLM (/v1/embeddings and /pooling token ID validation)High
• vLLM: incomplete NIXL kv_transfer_params kills the decode engine with an uncaught KeyErrorCVE-2026-94622 · vLLM NIXL KV connector (kv_transfer_params metadata handling)High