CVE-2026-61539: Xinference Llama3 Tool-Call eval() Remote Code Execution

Executive Summary

CVE-2026-61539 is a CVSS 10.0 critical remote code execution vulnerability in Xinference, a popular open-source inference API server for running Llama3, speech, and multimodal models. The flaw exists because Xinference passes attacker-influenced output from Llama3 tool calls directly into Python's eval() function — allowing an unauthenticated attacker with access to the /v1/chat/completions endpoint to execute arbitrary code on the host.

All versions 2.5.0 and earlier are affected. No CVSSv3.1 vector has been published yet, but the combination of network-reachable attack surface, no authentication requirement, and full code execution warrants treating this as maximum severity.

Vulnerability Details

Root Cause

The vulnerability originates in two files:

• xinference/model/llm/tool_parsers/llama3_tool_parser.py
• xinference/model/llm/utils.py

When a Llama3 model emits a tool call response (a JSON-formatted string in the model's output describing a function to invoke), Xinference extracts the function arguments and passes them to Python's built-in eval() without sanitization or sandboxing. Because the model output is influenced by user-supplied chat messages, an attacker can craft a prompt that causes Llama3 to emit a tool call response containing arbitrary Python code in the argument payload.

Attack Flow

1. Attacker sends a crafted message to POST /v1/chat/completions
2. Message is designed to cause Llama3 to output a tool-call response
   containing malicious Python code in the arguments JSON
3. Xinference's tool_parser extracts the arguments string
4. The arguments string is passed to eval() without validation
5. eval() executes the attacker's arbitrary Python code
6. Attacker achieves RCE with the privileges of the Xinference process

Why This Is Severe

Xinference deployments frequently run in GPU-enabled research environments or internal API hubs with broad network access, making lateral movement trivial after initial compromise.

Affected Versions

Check your version:

pip show xinference | grep Version
# or
xinference --version

Remediation

Upgrade (Recommended)

Update to Xinference 2.5.1 or later, which replaces the unsafe eval() call with a safe JSON parser:

pip install --upgrade xinference

Verify:

pip show xinference | grep Version

Network-Level Mitigation (Interim)

If upgrading immediately is not possible, restrict access to the inference endpoint:

# Bind Xinference to localhost only
xinference-local --host 127.0.0.1 --port 9997
 
# Or use firewall rules to restrict /v1/chat/completions access
iptables -A INPUT -p tcp --dport 9997 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 9997 -j DROP

Model-Level Consideration

Disabling tool-calling functionality for untrusted users also eliminates the attack surface while the patch is pending. However, upgrading remains the only complete fix.

Detection

Indicator: Unusual Process Spawning from Inference Worker

# Monitor for child processes from xinference workers
ps aux | grep -E "(xinference|uvicorn)" | awk '{print $2}' | \
  xargs -I{} sh -c 'ps --ppid {} --no-headers 2>/dev/null' | grep -v uvicorn

SIEM Query (Splunk)

index=app sourcetype=xinference_access
| where uri="/v1/chat/completions" AND method="POST"
| eval payload=urldecode(body)
| where match(payload, "(?i)(exec|subprocess|os\.|sys\.|__import__|open\()")
| stats count, values(src_ip) by user_agent

Log Review

Xinference logs abnormal eval errors when the injected payload causes exceptions:

ERROR xinference.model.llm.tool_parsers.llama3_tool_parser - eval error: ...

Repeated eval errors from the same source IP following user chat messages are a strong indicator of exploitation attempts.

Context: LLM Prompt Injection → Code Execution Chain

This vulnerability represents a class of risk that is increasingly common in agentic AI systems: prompt injection → tool call → unsafe code execution. The attack chain does not require breaking any cryptographic protection — it exploits the semantic gap between "model output is data" and "model output is trusted input to eval()."

Security teams deploying open-source inference servers should audit any framework that:

• Accepts raw model output as function call arguments
• Parses tool-call JSON into executable code paths
• Uses eval(), exec(), or compile() on model-generated strings

This class of vulnerability will become more prevalent as agentic pipelines expand the interface between LLM output and host system operations.

References

• NIST NVD — CVE-2026-61539
• Xinference GitHub
• GitHub Security Advisory (xorbitsai/inference)