xorbitsai vulnerabilities

Newest CVEs

• CVE-2026-112051

  Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

  xorbitsai · inference

  High8.3
• CVE-2026-49950

  Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

  xorbitsai · xoscar

  Critical9.3
• CVE-2026-85668

  Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

  xorbitsai · inference

  High8.7
• CVE-2026-76841

  Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

  xorbitsai · inference

  High8.7
• CVE-2026-61539

  Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

  xorbitsai · inference

  Critical10.0