Skip to content
OpenAdvisories

Vendor

xorbitsai

5 known vulnerabilities.

xorbitsai at a glance

Last 12 months
5
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 2 vulnerabilities, 1 critical September 2026: 1 vulnerability Sep October 2026: 2 vulnerabilities, 1 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202621
Sep 202610
Aug 202621
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

inference 4 xoscar 1
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 6.5
    CVE-2026-112051

    Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

    Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1…

    xorbitsai inference
  • Critical 9.8
    CVE-2026-49950

    Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

    Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalida…

    xorbitsai xoscar
  • High 7.5
    CVE-2026-85668

    Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register

    Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or path confinement. T…

    xorbitsai inference
  • High 8.8
    CVE-2026-76841

    Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

    Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trust_remote_code=True as a literal or as an unconditional default: RerankModel._ge…

    xorbitsai inference
  • Critical 10.0
    CVE-2026-61539

    Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

    Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/mode…

    xorbitsai inference xinference PyPI