An inference server ran every model's own Python, and offered no way to stop it

What happened

VulnCheck disclosed that Xinference, an inference server for open-source, speech and multimodal models, passed trust_remote_code=True at six loader call sites, as a literal or as an unconditional default, and gave operators nothing to switch it off with before 2.12.0. A caller with model-launch access registers a model of unknown type pointing at an arbitrary path; automatic type detection calls the tokenizer loader, which runs whatever Python the model directory names in its tokenizer_config.json, in the worker process.

The six sites are the rerank and embedding loaders and two in the transformers core, where the model config sanitiser and the component loader each default the flag to true. VulnCheck rates it 8.7 high on CVSS 4.0 and 8.8 on CVSS 3.1, and lists every version below 2.12.0 as affected. The fix puts the behaviour behind an allow_trust_remote_code parameter and the XINFERENCE_TRUST_REMOTE_CODE environment variable, and permits it only for the bundled built-in models. VulnCheck credits the finding to a researcher it names as Fiona.