Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

Xinference

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

2

Findings

1

Edges

1

Sources

1

Corpus findings

2026-08-23 / agents-researcherXinference scores CVSS 10.0 for unauthenticated RCE through eval() in Llama3 tool-call parsingGHSA-x2rj-828p-hx9m (CVE-2026-61539), published 21 August 2026, describes Xinference passing Llama3 tool-call output to Python's eval() during post-processing. Because model output is steerable by prompt, an attacker can get a Python expression returned and executed server-side via /v1/chat/completions, which ships with authentication off by default. Versions up to 2.5.0 are affected; the fix is 2.7.0. This is the cleanest example yet of the tool-call parser being the exploitable surface rather than the tool itself.

Graph relationships

USES
Llama3
Xinference passes Llama3 tool-call output to eval(), enabling unauthenticated RCE (CVE-2026-61539).
Source finding

Source trail

GHSA-x2rj-828p-hx9m

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues