Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentencetransformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentencetransformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel.sanitizemodelconfig and PytorchModel.getcomponents default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches autodetecttype and then AutoTokenizer.frompretrained, which imports and executes Python declared by the model directory's own tokenizerconfig.json automap, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allowtrustremotecode and the XINFERENCETRUSTREMOTECODE setting, permitting remote code only for bundled built-in models.