CVE-2026-76841Published
Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-76841 · Microsoft / collected KEV context
cve-program · CVE-2026-76841
- https://github.com/xorbitsai/inference
- https://github.com/xorbitsai/inference/issues/5023
- https://github.com/xorbitsai/inference/pull/5027
- https://github.com/xorbitsai/inference/blob/v2.11.0/xinference/model/rerank/core.py
- https://www.vulncheck.com/advisories/xinference-through-remote-code-execution-via-hardcoded-trust-remote-code-in-model-loaders
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.