Xinference loads models using Hugging Face's AutoTokenizer.from_pretrained with trust_remote_code=True unconditionally in multiple loader call sites before version 2.12.0. This enables an attacker who can register a model to supply a malicious model directory containing a tokenizer_config.json with an auto_map that imports and executes arbitrary Python code. Because the code runs with the privileges of the worker process, this constitutes a code injection vulnerability. Version 2.12.0 introduces controls to restrict remote code execution to only bundled built-in models via allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting.

An attacker with the ability to register a model can execute arbitrary code on the server with the privileges of the worker process. This can lead to full compromise of the inference service environment. The vulnerability affects all versions prior to 2.12.0 and allows remote code execution without user interaction or elevated privileges beyond model launch access.

Upgrade to version 2.12.0 or later, which introduces allow_trust_remote_code and the XINFERENCE_TRUST_REMOTE_CODE setting to restrict remote code execution to trusted built-in models only. Prior to upgrading, restrict model registration permissions to trusted users only to reduce risk. Patch status is not explicitly confirmed beyond the mention of version 2.12.0 gating the feature; check the vendor advisory for the latest remediation guidance.