TinyLLaVA Factory CVE-2026-108957

Requires the victim to invoke TinyLlavaConfig/_load_text_config with an attacker-controlled llm_model_name_or_path value - i.e., loading an untrusted or crafted model/config reference in tinyllava/model/configuration_tinyllava.py. Limiting factors: user interaction is required (UI:P) because an operator must point the loader at the hostile input (it does not fire against an untouched default deployment), and exploitation runs with the privileges of the process loading the config. No authentication is required per the vector (PR:N). No patched release exists due to the rolling-release model, so mitigation depends on only loading trusted model paths.

Signals are mostly low-to-moderate and partly self-reported. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) describes a network-reachable, low-complexity, unauthenticated flaw, but UI:P means a victim must passively load attacker-controlled input, and the vendor-rated impacts are only Low across VC/VI/VA, yielding a very low base score of 2.1. That low score conflicts with the vulnerability class: CWE-94 code injection in a config loader typically yields arbitrary code execution, which I would normally rate with High confidentiality/integrity/availability impact - this divergence should be verified rather than taken at face value. Exploitation maturity is E:P (proof-of-concept), and POC=YES is reported, so publicly available exploit code exists; however there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread or active exploitation. The single intelligence source is VulDB (self-submitted, submission #997884), and the project 'has not responded yet,' so none of this is vendor-confirmed. Net: this reads as a real but low-practical-priority issue - the realistic attack requires tricking a user into loading a malicious llm_model_name_or_path, and the affected product is a niche research/ML framework, so it is far from a mass-exploitation threat despite the code-injection class.

An attacker publishes or socially-engineers a victim into using a crafted llm_model_name_or_path value (e.g., a malicious model/config reference); when the victim instantiates TinyLlavaConfig and _load_text_config processes that argument, attacker-controlled code is injected and executed in the Python process. A public proof-of-concept is referenced in GitHub issue #212, but exploitation is not automatic - it depends on the victim loading the hostile path (UI:P).