Llama-Chinese CVE-2026-112080

Exploitation requires that the examples/chat_gradio_no_merge.py Gradio demo is actually deployed AND that an attacker can influence the base_model_name_or_path argument consumed by get_class_from_dynamic_module (the Adapter Config component) - typically by getting an operator to load an attacker-controlled model/adapter path or remote module. Limiting factors: this is example/demo code rather than a core library API, so most installations never expose it; the CVSS flag UI:P indicates passive user interaction is needed (a victim must load/process the crafted value); there is no fixed release (rolling release, versions undisclosed) and no vendor response. These constraints sharply narrow realistic exploitation despite the AV:N/PR:N labeling.

Signals conflict sharply and should be read with caution. VulDB (the sole source) assigns a CVSS 4.0 base score of 2.1 (Low) with partial impacts (VC:L/VI:L/VA:L) and passive user interaction (UI:P), yet the CWE (CWE-94, code injection) and tags (RCE, Code Injection) describe a bug class that normally yields full code execution - so the published score likely understates technical impact while correctly capturing that the attack surface is narrow. The vector advertises a network, low-complexity, unauthenticated path (AV:N/AC:L/PR:N), but the vulnerable input, base_model_name_or_path, is an operator-/config-controlled model path in an example Gradio demo script (examples/chat_gradio_no_merge.py), not a routine remote request parameter, so real exploitation depends on an operator or victim being induced to load an attacker-supplied path (consistent with UI:P). A public exploit (poc.zip) exists, which raises opportunistic risk, but there is NO CISA KEV listing and NO EPSS value provided, so there is no evidence of active, widespread exploitation - POC availability is not the same as in-the-wild use. No SSVC decision data was supplied. Net: this is a real but low-priority issue for most environments - meaningful only where this specific demo script is actually deployed and its model-path input is attacker-influenceable; the 'remote/unauthenticated' framing should be verified against how the argument is actually exposed.

An operator runs the chat_gradio_no_merge.py demo and is induced to load an attacker-supplied base_model_name_or_path (e.g., a crafted adapter config / remote module); when get_class_from_dynamic_module resolves it, attacker-controlled code executes in the application's process. A public proof-of-concept (poc.zip) exists; the CVSS passive user-interaction flag (UI:P) indicates the victim must load or process the malicious value rather than it triggering fully unattended.