Hiyouga
Monthly
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Remote code execution in LLaMA-Factory through version 0.9.5 allows attackers who can reach the Gradio WebUI to run arbitrary Python by entering a malicious model path in the Chat or Training interfaces. Because the app forwards unvalidated user input into Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True, a referenced repository's custom modeling code executes with the server process's privileges. Publicly available exploit code exists (a proof-of-concept gist plus a VulnCheck advisory), though it is not listed in CISA KEV and no in-the-wild abuse is documented in the available data.
LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`. Version 0.9.4 contains a fix for the issue.
LLama Factory enables fine-tuning of large language models. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. Public exploit code available.
LLama Factory enables fine-tuning of large language models. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Remote code execution in LLaMA-Factory through version 0.9.5 allows attackers who can reach the Gradio WebUI to run arbitrary Python by entering a malicious model path in the Chat or Training interfaces. Because the app forwards unvalidated user input into Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True, a referenced repository's custom modeling code executes with the server process's privileges. Publicly available exploit code exists (a proof-of-concept gist plus a VulnCheck advisory), though it is not listed in CISA KEV and no in-the-wild abuse is documented in the available data.
LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`. Version 0.9.4 contains a fix for the issue.
LLama Factory enables fine-tuning of large language models. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. Public exploit code available.
LLama Factory enables fine-tuning of large language models. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.