Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Fix availableCritical · CVSS 10EPSS 1.2%

Published Aug 21, 2026 · updated Oct 8, 2026

What to do

  1. Upgrade to a fixed version: xinference 2.7.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIxinference

Vulnerable versions
<= 2.5.0
Fixed in
2.7.0

Check your project: pip show xinference

Sources

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

← All critical vulnerabilities