{"uuid": "1e50062e-4c6c-4947-aea0-6a844f319701", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61539", "type": "seen", "source": "https://gist.github.com/alon710/81c41b230edf2bb67889e76531f6c94f", "content": "# CVE-2026-61539: CVE-2026-61539: Remote Code Execution via Llama3 Tool Parser Eval Injection in Xinference\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61539\n\n## Summary\nCVE-2026-61539 is a critical remote code execution vulnerability in Xinference, an inference API framework for open-source LLMs. In version 2.5.0 and earlier, model-generated outputs representing Llama3 tool calls are passed directly to Python's built-in eval() function inside the parser components. By manipulating conversational input or injecting instructions, an attacker can influence the LLM to output a Python expression containing malicious system commands, resulting in unauthenticated remote code execution on the host. This vulnerability has been resolved in Xinference version 2.7.0.\n\n## TL;DR\nUnsafe use of Python's eval() in Xinference's Llama3 tool parser enables unauthenticated remote code execution via prompt injection. Upgrading to version 2.7.0 mitigates this risk by replacing eval() with json.loads() and ast.literal_eval().\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-95\n- **Attack Vector**: Network\n- **CVSS Score**: 10.0\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- xorbitsai/inference (Xinference) API Service\n- **inference**: <= 2.5.0 (Fixed in: `2.7.0`)\n\n## Mitigation\n\n- Upgrade to Xinference v2.7.0 or higher\n- Implement network segmentation to protect the API port\n- Enforce API authentication using firewalls or API gateways\n- Run the application with an unprivileged system user\n\n**Remediation Steps:**\n1. Identify all active deployments of xorbitsai/inference.\n2. Verify the current version of the deployments using the API or environment checks.\n3. Update the deployment configurations to pull image version 2.7.0 or higher.\n4. Restart the services and verify that the /v1/chat/completions endpoint operates correctly.\n\n## References\n\n- [GitHub Security Advisory GHSA-x2rj-828p-hx9m](https://github.com/xorbitsai/inference/security/advisories/GHSA-x2rj-828p-hx9m)\n- [NVD CVE-2026-61539 Detail Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-61539)\n- [CVE Org Record CVE-2026-61539](https://www.cve.org/CVERecord?id=CVE-2026-61539)\n- [Xinference v2.7.0 Release Notes](https://github.com/xorbitsai/inference/releases/tag/v2.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61539) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T03:31:16.520468Z"}