High · CVSS 8.7CVE-2026-76841

Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model LoadersCVE-2026-76841

Answer in brief

CVE-2026-76841 records a High severity (CVSS 8.7) vulnerability in Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders. The current sources do not mark it as known exploited. The current feed maps xorbitsai/inference (generic), xorbitsai/xinference (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 24, 2026Updated Oct 1, 2026Source checked Oct 8, 2026First seen by HOL Aug 24, 2026Material review Oct 1, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.7
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps xorbitsai/inference (generic), xorbitsai/xinference (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
xorbitsai/inferencegeneric	>=0 <2.12.0	2.12.0
xorbitsai/xinferencegeneric	>=0 <2.12.0	2.12.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for xorbitsai/inference, xorbitsai/xinference.
Review the reported fix. Update xorbitsai/inference to 2.12.0; xorbitsai/xinference to 2.12.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 24, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 1, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 24, 2026

Sources and claim methodology

Upstream source description

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._get_tokenizer in xinference/model/rerank/core.py, SentenceTransformerRerankModel.load in xinference/model/rerank/sentence_transformers/core.py, SentenceTransformerEmbeddingModel.load in xinference/model/embedding/sentence_transformers/core.py, FlagEmbeddingModel.load in xinference/model/embedding/flag/core.py, and two sites in xinference/model/llm/transformers/core.py where PytorchModel._sanitize_model_config and PytorchModel._get_components default the value to True. Because a caller with model launch access can register a model whose type is unknown and supply an arbitrary model path, the server reaches _auto_detect_type and then AutoTokenizer.from_pretrained, which imports and executes Python declared by the model directory's own tokenizer_config.json auto_map, running attacker-supplied code with the privileges of the worker process. Version 2.12.0 gates every site behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code only for bundled built-in models.

Quoted source text, attributed separately from HOL analysis.