Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/{modeltype} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.

Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizerconfig.json, and chattemplate.jinja files at the supplied path and reflects the parsed content back to the caller, allowing an unauthenticated attacker to probe the server filesystem and extract content of files with those names in any directory.

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentencetransformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentencetransformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel.sanitizemodelconfig and PytorchModel.getcomponents default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches autodetecttype and then AutoTokenizer.frompretrained, which imports and executes Python declared by the model directory's own tokenizerconfig.json automap, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allowtrustremotecode and the XINFERENCETRUSTREMOTECODE setting, permitting remote code only for bundled built-in models.

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.