Xinference allows the model to output arbitrary Python code in Llama3 tool‑call responses, which the service then passes directly to eval(). An attacker who can craft a prompt and submit it to the /v1/chat/completions endpoint can inject malicious code that is executed in the server process, granting full control over the host. This flaw stems from an unsanitized use of eval() (CWE‑95) and enables remote code execution without authentication.

The vulnerability exists in the xorbitsai inference API version 2.5.0 and all earlier releases. All installations that have not applied the official fix in release 2.7.0 are affected. The issue arises from code located in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py, and is triggered by requests to the chat completion endpoint when tool‑calls are enabled.

The CVSS score of 10.0 indicates a critical severity. Although EPSS data is not available, the description confirms that an unauthenticated remote attacker can exploit the flaw by crafting a malicious prompt. The vulnerability is not listed in CISA’s KEV catalog, but the lack of an authentication boundary and the use of eval() make it a high‑risk target. The likely attack vector is any network reachable to the Xinference API, with local code execution running in the server process as the attacker’s user.