{"data":{"id":"605f8b28-a79f-4634-ae6c-ebdbaf95f05f","title":"CVE-2026-76841: Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 expos","summary":"Xinference (a model-serving tool) was loading AI models from Hugging Face with remote code execution (the ability to run code from external sources) always enabled before version 2.12.0, and users had no way to turn it off. An attacker who could register a new model could trick the system into running malicious code hidden in the model's configuration files, giving that code the same permissions as the server running Xinference.","solution":"Version 2.12.0 fixes this by adding a new setting called allow_trust_remote_code and an environment variable XINFERENCE_TRUST_REMOTE_CODE that gates remote code execution. After the update, remote code is only allowed for built-in models that come bundled with Xinference.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76841","publishedAt":"2026-08-24T14:17:01.760Z","cveId":"CVE-2026-76841","cweIds":["CWE-94"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain","model_poisoning"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["Xinference","Hugging Face","Sentence Transformers","Flag Embedding"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-24T14:17:01.760Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"model","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}