Llama Factory
Monthly
Remote code execution in LLaMA-Factory through version 0.9.5 allows attackers who can reach the Gradio WebUI to run arbitrary Python by entering a malicious model path in the Chat or Training interfaces. Because the app forwards unvalidated user input into Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True, a referenced repository's custom modeling code executes with the server process's privileges. Publicly available exploit code exists (a proof-of-concept gist plus a VulnCheck advisory), though it is not listed in CISA KEV and no in-the-wild abuse is documented in the available data.
Server-side request forgery and local file inclusion in LLaMA-Factory through 0.9.3 let a user of the public /v1/chat/completions endpoint force the server to issue arbitrary outbound HTTP requests and read files from the server's filesystem. The flaw sits in the multimodal media handling path of _process_request, which accepts image_url, video_url and audio_url fields and passes any value that is not a base64 data URI or an existing local file straight into requests.get() with no scheme, host or address validation; the advisory frames the attacker as 'any authenticated user' (PR:L), so a valid API bearer token is the gating factor, but deployments started without an API key leave the endpoint effectively reachable by anyone who can route to it. Publicly available exploit code exists (the advisory ships a curl payload aimed at the AWS instance metadata service), no CISA KEV entry is associated with this CVE, and the risk is rated 8.1 under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, while the independently assessed vector scores integrity impact as none and treats confidentiality loss as the primary consequence.
LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`. Version 0.9.4 contains a fix for the issue.
LLama Factory enables fine-tuning of large language models. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. Public exploit code available.
LLama Factory enables fine-tuning of large language models. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Remote code execution in LLaMA-Factory through version 0.9.5 allows attackers who can reach the Gradio WebUI to run arbitrary Python by entering a malicious model path in the Chat or Training interfaces. Because the app forwards unvalidated user input into Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True, a referenced repository's custom modeling code executes with the server process's privileges. Publicly available exploit code exists (a proof-of-concept gist plus a VulnCheck advisory), though it is not listed in CISA KEV and no in-the-wild abuse is documented in the available data.
Server-side request forgery and local file inclusion in LLaMA-Factory through 0.9.3 let a user of the public /v1/chat/completions endpoint force the server to issue arbitrary outbound HTTP requests and read files from the server's filesystem. The flaw sits in the multimodal media handling path of _process_request, which accepts image_url, video_url and audio_url fields and passes any value that is not a base64 data URI or an existing local file straight into requests.get() with no scheme, host or address validation; the advisory frames the attacker as 'any authenticated user' (PR:L), so a valid API bearer token is the gating factor, but deployments started without an API key leave the endpoint effectively reachable by anyone who can route to it. Publicly available exploit code exists (the advisory ships a curl payload aimed at the AWS instance metadata service), no CISA KEV entry is associated with this CVE, and the risk is rated 8.1 under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, while the independently assessed vector scores integrity impact as none and treats confidentiality loss as the primary consequence.
LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`. Version 0.9.4 contains a fix for the issue.
LLama Factory enables fine-tuning of large language models. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. Public exploit code available.
LLama Factory enables fine-tuning of large language models. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.