CVE-2026-58116 Details
Description
LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.
A remote code execution vulnerability has been identified in LLaMA-Factory versions through 0.9.5. This vulnerability allows attackers with WebUI access to execute arbitrary Python code by providing a malicious model path in the Chat or Training interfaces. The application fails to validate user-supplied model path input, which is then passed directly into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter. This flaw causes the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository, using the privileges of the server process.
Users are advised to update to the latest version of LLaMA-Factory, as this vulnerability has been patched. For those unable to update, consider removing WebUI access or implementing additional input validation to prevent the injection of malicious model paths.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/henrrrychau/08d76ec672f42136bbc1449c4f2973f8 | [email protected] | ExploitMitigationThird Party Advisory |
| https://www.vulncheck.com/advisories/llama-factory-remote-code-execution-via-webui-model-path | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hiyouga llama-factory | <= 0.9.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 1, 2026 | Initial Analysis | [email protected] |
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |