Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always on

Impact

Six loader call sites in Xinference pass trust_remote_code=True unconditionally, and before 2.12.0 there is no setting to turn it off. Anyone who can call the model-launch API can register a model of unknown type pointing at an arbitrary model path; the server falls through to AutoTokenizer.from_pretrained, which imports and runs Python named by that directory's tokenizer_config.json auto_map. The code runs as the Xinference worker process, which on a GPU node is normally a long-lived process holding the GPU, the model cache and any registry or object-store credentials the fleet gave it. On a shared inference cluster this turns a low-privilege serving account into code execution on every worker that picks up the launch request.

Who can reach it

Any authenticated user with model-launch access to the Xinference API, including a tenant on a shared inference endpoint. No admin role and no host access needed - supplying a model path is enough.

What to do

Upgrade to Xinference 2.12.0 or later, where every loader is gated behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting and remote code is permitted only for bundled built-in models. Restart the supervisor and every worker after upgrading; the GPUs are released and reloaded, so models must be re-warmed but nodes do not need rebooting. Until then, restrict who can reach the launch API and do not accept tenant-supplied model paths.

References

Related entries

• Gradio (`/queue/join`): SSRFCVE-2024-4325 · Gradio (`/queue/join`)High
• ONNX: Security-control bypass through 1.20.1CVE-2026-28500 · ONNXHigh
• ONNX (`ExternalDataInfo`): Security control bypass in external-data path handlingCVE-2026-34445 · ONNX (`ExternalDataInfo`)High
• LocalAI (`/models/apply`): Unauthenticated SSRF fetching arbitrary internal URLsCVE-2026-59707 · LocalAI (`/models/apply`)High
• Text Generation Inference (TGI): SSRF in the OpenAI-compatible multimodal chat endpointCVE-2026-63086 · Text Generation Inference (TGI)High
• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High