Which versions of Python are affected by CVE-2026-58116?

LLaMA-Factory up to version 0.9.5 contains a critical remote code execution vulnerability; publicly available exploit code exists that allows attackers to compromise any system running the WebUI.

How to fix or mitigate CVE-2026-58116?

24 hours: Identify all LLaMA-Factory deployments running version 0.9.5 or earlier; restrict network access to the Gradio WebUI via firewall rules, limiting access to localhost or internal networks only. 7 days: Implement network segmentation to isolate systems running LLaMA-Factory; disable Chat and Training interface features if not business-critical. 30 days: Evaluate and begin migration to alternative ML tools with active security support; monitor LLaMA-Factory repository for security releases; establish a timeline for complete removal of vulnerable versions.

Python CVE-2026-58116

Q: What is the CVSS score of CVE-2026-58116?

CVE-2026-58116 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40311 CRITICAL

Code Injection (CWE-94)

2026-06-30 disclosure@vulncheck.com

GHSA-mwc7-mf87-v3mf

RCE Python Code Injection Llama Factory Hiyouga

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 13:32 vuln.today

DescriptionCVE.org

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Articles & Coverage 2

News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jul 01, 2026 News Critical RCE in LLaMA-Factory via Gradio WebUI through 0.9.5 - CVE-2026-58116 Jun 30, 2026

AnalysisAI

Remote code execution in LLaMA-Factory through version 0.9.5 allows attackers who can reach the Gradio WebUI to run arbitrary Python by entering a malicious model path in the Chat or Training interfaces. Because the app forwards unvalidated user input into Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True, a referenced repository's custom modeling code executes with the server process's privileges. Publicly available exploit code exists (a proof-of-concept gist plus a VulnCheck advisory), though it is not listed in CISA KEV and no in-the-wild abuse is documented in the available data.