CVE-2026-76841 Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

Xinference loads models with Hugging Face remote code execution unconditionally enabled, and before version 2.12.0 exposes no setting to disable it. Six loader call sites pass trustremotecode=True as a literal or as an unconditional default: RerankModel.gettokenizer in...