OpenLLM CVE-2026-15035

Exploitation requires local system access with at minimum low-privilege credentials (AV:L/PR:L per the CVSS 4.0 vector) - remote exploitation is not possible based on available data. The vulnerable code path is triggered by passing a crafted argument to the async_run_command function in src/openllm/common.py via the Model Repository Directory Name Handler, which implies the attacker must be able to invoke model repository operations within OpenLLM. No user interaction from a third party is required (UI:N). Limiting factors include: the strictly local attack vector (eliminates all remote threat actors), the low-privilege requirement (eliminates unauthenticated scenarios), the Low-bounded impact (C:L/I:L/A:L - no confirmed path to privilege escalation or root access), and the niche deployment context of an ML serving framework. No special non-default configuration is described as required - the vulnerability appears reachable in a standard OpenLLM 0.6.30 deployment by any local low-privilege user who can interact with model management operations.

Real-world risk is meaningfully constrained by several converging signals. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attack requires physical or logical local access with at minimum low-privilege credentials - remote exploitation is not supported by the available data. Impact is bounded to Low across confidentiality, integrity, and availability with no scope change to subsequent systems (SC:N/SI:N/SA:N), indicating the injection does not automatically escalate privileges or pivot to other systems. No EPSS data was provided, and no CISA KEV listing exists, suggesting no confirmed widespread exploitation. The E:P modifier confirms a public proof-of-concept exists, which lowers the skill barrier for local insiders or users who already have system access. The combination of local-only vector, low impact ceiling, and niche deployment footprint makes this a low-priority finding for most organizations, though it warrants patching in multi-tenant or shared ML infrastructure environments where untrusted local users exist.

A local user with low-privilege access to a system running OpenLLM 0.6.30 crafts a model repository directory name containing shell metacharacters (e.g., semicolons, backticks, or pipe characters) and supplies it as input to an OpenLLM model management operation. The async_run_command function in src/openllm/common.py passes the unsanitized argument to a shell or subprocess context, causing injected commands to execute with the privileges of the OpenLLM process. A public proof-of-concept is available, reducing the technical barrier for any user who already holds local system access.