Xorbitsai Inference
3 CVEs affecting Xorbitsai Inference. Latest disclosed: 2026-09-04. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61539 | Critical | 10.0 | 2026-08-21 | Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-… |
CVE-2026-76841 | High | 8.8 | 2026-08-24 | Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader… |
CVE-2026-85668 | High | 7.5 | 2026-09-04 | Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint… |