Xinference, an AI model serving framework, unconditionally enables Hugging Face's trust_remote_code flag across six loader call sites prior to version 2.12.0, with no mechanism to disable it. Affected functions include RerankModel._get_tokenizer, SentenceTransformerRerankModel.load, SentenceTransformerEmbeddingModel.load, FlagEmbeddingModel.load, PytorchModel._sanitize_model_config, and PytorchModel._get_components. An attacker with model launch access can register a model with an unknown type and supply an arbitrary model path, causing the server to invoke AutoTokenizer.from_pretrained, which executes Python code declared in a malicious tokenizer_config.json auto_map field. This results in attacker-supplied code running with the privileges of the worker process. Version 2.12.0 mitigates the issue by gating all affected sites behind the allow_trust_remote_code flag and the XINFERENCE_TRUST_REMOTE_CODE environment setting, restricting remote code execution to bundled built-in models only.
