CVE-2026-76841: Improper Control of Generation of Code ('Code Injection') in xorbitsai inference

Xinference versions before 2.12.0 load models using Hugging Face's AutoTokenizer.from_pretrained with the trust_remote_code parameter set to True unconditionally at six loader call sites. This means that when a model is loaded, Python code declared by the model's tokenizer_config.json auto_map is executed without restriction. An attacker who can register a model with an arbitrary path can trigger this code execution, running arbitrary code with the worker process's privileges. Version 2.12.0 mitigates this by gating all such calls behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, allowing remote code execution only for bundled built-in models.

An attacker with access to launch models on the server can execute arbitrary code remotely with the privileges of the worker process. This can lead to full compromise of the inference server, data theft, or further lateral movement within the environment. The vulnerability has a CVSS 4.0 score of 8.7 (high severity), reflecting the network attack vector, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade xorbitsai inference to version 2.12.0 or later, which introduces configuration options to disable untrusted remote code execution. Specifically, version 2.12.0 gates all trust_remote_code calls behind allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting, permitting remote code execution only for bundled built-in models. Until upgraded, restrict model launch access to trusted users only to reduce risk.