CVE-2026-61539: CVE-2026-61539: Remote Code Execution via Llama3 Tool Parser Eval Injection in Xinference

#security #cve #cybersecurity

CVE-2026-61539: Remote Code Execution via Llama3 Tool Parser Eval Injection in Xinference

Vulnerability ID: CVE-2026-61539
CVSS Score: 10.0
Published: 2026-08-21

CVE-2026-61539 is a critical remote code execution vulnerability in Xinference, an inference API framework for open-source LLMs. In version 2.5.0 and earlier, model-generated outputs representing Llama3 tool calls are passed directly to Python's built-in eval() function inside the parser components. By manipulating conversational input or injecting instructions, an attacker can influence the LLM to output a Python expression containing malicious system commands, resulting in unauthenticated remote code execution on the host. This vulnerability has been resolved in Xinference version 2.7.0.

TL;DR

Unsafe use of Python's eval() in Xinference's Llama3 tool parser enables unauthenticated remote code execution via prompt injection. Upgrading to version 2.7.0 mitigates this risk by replacing eval() with json.loads() and ast.literal_eval().

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-95
Attack Vector: Network
CVSS Score: 10.0
Impact: Arbitrary Code Execution
Exploit Status: Proof-of-Concept
KEV Status: Not Listed

Affected Systems

xorbitsai/inference (Xinference) API Service
inference: <= 2.5.0 (Fixed in: 2.7.0)

Exploit Details

GitHub Security Advisory: Details explaining prompt injection vector triggering python eval function execution.

Mitigation Strategies

Upgrade to Xinference v2.7.0 or higher
Implement network segmentation to protect the API port
Enforce API authentication using firewalls or API gateways
Run the application with an unprivileged system user

Remediation Steps:

Identify all active deployments of xorbitsai/inference.
Verify the current version of the deployments using the API or environment checks.
Update the deployment configurations to pull image version 2.7.0 or higher.
Restart the services and verify that the /v1/chat/completions endpoint operates correctly.

References

Read the full report for CVE-2026-61539 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community