Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-23 · high
A CVSS 10 flaw feeds Llama3 tool-call output straight into Python's eval, and the API has no auth on by default.
Why now: This lands in the August 23 security briefing, two days after the advisory itself, with the fix already available in Xinference 2.7.0.
Xinference feeds Llama3 tool-call output straight into Python's eval() during post-processing, per GHSA-x2rj-828p-hx9m (CVE-2026-61539), published August 21.
CVSS scored the flaw a perfect 10.0. That's unauthenticated remote code execution, reachable through /v1/chat/completions, an endpoint that ships with authentication off by default.
Model output is steerable by prompt. An attacker can steer the model into returning a Python expression, and Xinference executes it directly on the server.
The bug hits every Xinference deployment up to version 2.5.0. It's fixed in 2.7.0.
The vulnerable code is the parser reading tool-call output. Xinference ran the model's returned text as executable Python instead of treating it as inert data.
The advisory doesn't say how widely 2.5.0 and earlier were deployed, or whether anyone exploited the bug before the fix shipped. It also doesn't cover Xinference's other model backends, only that the Llama3 tool-call path was wired to eval.
Running Xinference means upgrading to 2.7.0 and checking whether the endpoint has authentication turned on, since the default is off.
Each link below shares sources, entities, or timing with this story.
Atlas benchmarked against Llama3 / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Atlas benchmarked against Llama3); both cover August, Python; reported by the same outlet (github.com).
Claude Code uses Python / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Python); both cover August, CVE; reported by the same outlet (github.com).
Shared entities / Same source domain
Both cover Affects, CVE, CVSS, GHSA; reported by the same outlet (github.com).
OpenHands uses Python / Shared entity: August / Same source domain / Earlier coverage
Linked by a graph relationship (OpenHands uses Python); both cover August; reported by the same outlet (github.com).
Claude Code uses Python / Shared entities / Earlier coverage
Linked by a graph relationship (Claude Code uses Python); both cover August, CVE, CVSS; earlier August coverage from 2026-08-09.
Linked by a graph relationship (Claude Code uses Python); both cover CVE, CVSS, RCE; earlier CVE coverage from 2026-03-05.
Linked by a graph relationship (Claude Code uses Python); both cover CVE, CVSS, RCE; earlier CVE coverage from 2026-03-03.
Shared entities / Shared topic / Earlier coverage
Both cover Affects, CVE, CVSS; overlapping topics (affect, auth, chat); earlier Affects coverage from 2026-06-08.