CVE-2026-58116

CRITICAL

LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-58116. PoCs published by HermesNA-1, Hunt-Benito.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-58116, a remote code execution vulnerability in LLaMA-Factory through version 0.9.5. The module includes placeholder code with no functional exploit implementation, only basic connectivity checks and references to external sources for the actual PoC.

Description

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Exploits (2)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-58116_llama-factory_through_095.py

This repository contains an auto-generated stub module for CVE-2026-58116, a remote code execution vulnerability in LLaMA-Factory through version 0.9.5. The module includes placeholder code with no functional exploit implementation, only basic connectivity checks and references to external sources for the actual PoC.

Classification
Stub 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: LLaMA-Factory <= 0.9.5
Auth required
Prerequisites: WebUI access to the target LLaMA-Factory instance · Ability to supply a malicious model path in Chat or Training interfaces
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →
github WORKING POC
by Hunt-Benito · pythonpoc
https://github.com/Hunt-Benito/llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection

This repository contains a functional proof-of-concept exploit for CVE-2026-58116, demonstrating remote code execution in LLaMA-Factory WebUI via the `trust_remote_code` parameter. The exploit leverages Hugging Face `transformers` to execute arbitrary Python code when loading a malicious model repository.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: LLaMA-Factory WebUI <= v0.9.5
No auth needed
Prerequisites: Hugging Face `transformers` library · LLaMA-Factory WebUI with `trust_remote_code=True` hardcoded
mistral-large-3 · analyzed Jul 02, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit technical-description exploit
Researcher Disclosure
https://gist.github.com/henrrrychau/08d76ec672f42136bbc1449c4f2973f8

Scores

CVSS v3 9.8
EPSS 0.0064
EPSS Percentile 47.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-829 CWE-94
Status published
Products (2)
hiyouga/llama-factory < 0.9.5
hiyouga/LlamaFactory < 0.9.5
Published Jun 30, 2026
Tracked Since Jun 30, 2026