xorbitsai inference vulnerabilities

Latest xorbitsai inference CVEs

Newest publication first

1. CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

   Published 2026-08-21

   Critical·CVSS 10.0 EPSS 1.2%

   Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Reque...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.