CVE-2026-76841: Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders
Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentencetransformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentencetransformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel.sanitizemodelconfig and PytorchModel.getcomponents default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches autodetecttype and then AutoTokenizer.frompretrained, which imports and executes Python declared by the model directory's own tokenizerconfig.json automap, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allowtrustremotecode and the XINFERENCETRUSTREMOTECODE setting, permitting remote code only for bundled built-in models.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xinferenceto a version that resolves this vulnerability.Fixed in 2.12.0 - Configuration
Set XINFERENCE_TRUST_REMOTE_CODE to disable trust of remote code; in v2.12.0 this gates allow_trust_remote_code and only permits remote code for bundled built-in models.
Xinference XINFERENCE_TRUST_REMOTE_CODE = disabled - Configuration
Ensure trust_remote_code is not left as True at the loader call sites (RerankModel._get_tokenizer, SentenceTransformerRerankModel.load, SentenceTransformerEmbeddingModel.load, FlagEmbeddingModel.load, and the two PytorchModel call sites) so remote code is not executed when loading models.
Xinference model loaders trust_remote_code = false
Event History
Frequently Asked Questions
Who needs access to exploit this issue?
An attacker needs model launch access so they can register a model with an unknown type and provide an arbitrary model path. No user interaction is required.
What privileges does the attacker’s code receive?
Python code declared by the model directory’s tokenizer_config.json auto_map is executed with the privileges of the Xinference worker process.
Can affected releases disable remote model code execution through configuration?
Versions before 2.12.0 do not provide a setting to disable this behavior. Version 2.12.0 gates the affected loader paths behind allow_trust_remote_code.
Which model-loading paths are affected?
Affected paths include rerank, sentence-transformer rerank, sentence-transformer embedding, FlagEmbedding embedding, and two Transformers LLM loader paths in PytorchModel. The issue occurs during type auto-detection when AutoTokenizer.from_pretrained processes a supplied model directory.