The vulnerability is a CWE-94 flaw: Xinference until version 2.11.0 hardcodes the trust_remote_code flag to true in several model loader locations, forcing the use of Hugging Face’s AutoTokenizer.from_pretrained without checks. An attacker who can register a model on the server can supply a model path that contains a tokenizer_config.json with an auto_map entry pointing to arbitrary Python code. When the server loads the model, this code is executed with the same privileges as the worker process, allowing full control over the host.

The vulnerability affects the xorbitsai:inference product, specifically versions prior to 2.12.0. Version 2.12.0 and later introduce a gate behind the allow_trust_remote_code flag and the XINFERENCE_TRUST_REMOTE_CODE setting, restricting remote code execution to bundled built‑in models alone.

The CVSS score of 8.7 indicates a high severity flaw. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have model launch access on the Xinference server, after which the server automatically loads the attacker‑supplied model and runs the embedded code with worker‑process privileges. The attack vector is likely via the model registration interface or API, which is typically exposed to authorized users.