Skip to content
OpenAdvisories

Vendor

xorbitsai

5 known vulnerabilities.

Products

inference 4 xoscar 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-49950

    Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

    Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalida…

    xorbitsai xoscar
  • Critical 10.0
    CVE-2026-61539

    Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

    Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/mode…

    xorbitsai inference xinference PyPI