whichllm CVE-2026-58474

The attacker must control a HuggingFace repository and craft one or more GGUF filenames containing Python string metacharacters - such as double quotes, backslashes, or semicolons - that break out of the generated script's string literal context. The victim must be running whichllm in a version prior to 0.5.16 and must actively invoke the run or snippet subcommand targeting the attacker's repository (e.g., whichllm run attacker/model-name). No special server-side configuration or victim-side authentication beyond normal tool operation is required. Exploitation is limited by the need for active user interaction: the victim must choose to query the attacker's specific repository, meaning the attacker must plausibly surface their repository to the target population - typically via social engineering in model-sharing communities, leaderboard manipulation, or typosquatting of popular model names. The vulnerability does not affect users who invoke whichllm only against repositories they themselves own and control.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) scores 8.6, reflecting high real-world impact constrained by a single prerequisite: the victim must actively invoke whichllm run or whichllm snippet against the attacker's repository. On the attacker side, complexity is genuinely low - a free HuggingFace account and basic knowledge of Python string syntax are sufficient to craft the payload. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified numerically; however, the vulnerability class - unsanitized string interpolation into dynamically executed code - is thoroughly understood and the open-source codebase makes technique reproduction straightforward. The primary attack friction is social engineering: the attacker must surface a malicious repository to practitioners who routinely explore third-party models via community forums, Discord servers, and leaderboard sites, making this a realistic delivery vector for the tool's target population. No active exploitation is confirmed in CISA KEV and no public POC is referenced in the available intelligence - these signals moderate immediate urgency relative to the theoretical severity. The vendor-confirmed patch in v0.5.16 directly addresses the root cause with proper escaping, making remediation low-cost and unambiguous.

An attacker registers a HuggingFace account and publishes a model repository in which a GGUF file is named with embedded Python - for example, a filename containing a closing double-quote followed by arbitrary statements such as os.system calls or reverse shell payloads. When a developer discovers this model via a forum recommendation and runs whichllm run attacker/malicious-model, whichllm queries the Hub API, retrieves the crafted rfilename value, interpolates it unescaped into a generated Python script, and executes that script - running the attacker's payload on the developer's workstation before any download dialog or integrity check occurs. No public proof-of-concept is referenced in the available intelligence, though the technique is straightforward to reproduce given the publicly available source code.