P3Verified

CVE-2026-61539: xinference <= 2.5.0

CVE-2026-61539 affects xinference. CVSS 3.1 base score 10.0 (GitHub Advisory Database). EPSS 0.01226 (percentile 0.67933), scored 2026-10-08. Affected range: <= 2.5.0. Fixed version: 2.7.0.

Affected technology

xinference · <= 2.5.0
Vendor not specified by the source

Component: Not specified by the source
Function: when

Attack conditions (GitHub Advisory Database, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote attacker can craft prompts that cause the model to return a Python expression. GitHub Advisory Database’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.

Published 2026-10-08 18:30:38.215556+00:00

Product: xinference
CCR priority: 40.3 /100 (P3)
CVSS 3.1: 10.0 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · GitHub Advisory Database
EPSS: 0.01226 · percentile 0.67933 · 2026-10-08
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-08 18:27:24.781324+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-61539.html