What happened
NVD published CVE-2026-76841 (CVSS 8.8 High) on 2026-08-24, describing how Xinference's model loaders (including RerankModel._get_tokenizer and five other call sites) always pass trust_remote_code=True to Hugging Face's transformers library, with no configuration to disable it before version 2.12.0.
Why it matters
trust_remote_code=True is one of the most dangerous settings in the Hugging Face ecosystem because it executes arbitrary Python from the model repository at load time; hardcoding it with no opt-out removes a critical safety control from a widely-used local-LLM-serving platform, exposing any deployment that loads models from less-than-fully-vetted sources to full RCE.
Attack vector
An attacker who can influence which Hugging Face model/repo an Xinference instance loads (e.g., via a malicious or typosquatted model repo, or a compromised/attacker-controlled model reference) achieves arbitrary code execution on the server because Xinference's RerankModel and other loader call sites pass trust_remote_code=True unconditionally, running attacker-supplied Python code embedded in the model repo during load.
Affected systems
Xorbitsai Xinference < 2.12.0
Mitigation
Upgrade to Xinference >= 2.12.0, which is expected to add a setting to disable trust_remote_code. Until patched, only load models from fully trusted, pinned-revision repositories and avoid dynamic/user-controlled model-repo selection.