CVE-2026-58116
CRITICALLLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-58116. PoCs published by HermesNA-1, Hunt-Benito.
AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-58116, a remote code execution vulnerability in LLaMA-Factory through version 0.9.5. The module includes placeholder code with no functional exploit implementation, only basic connectivity checks and references to external sources for the actual PoC.
Description
LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.
Exploits (2)
This repository contains an auto-generated stub module for CVE-2026-58116, a remote code execution vulnerability in LLaMA-Factory through version 0.9.5. The module includes placeholder code with no functional exploit implementation, only basic connectivity checks and references to external sources for the actual PoC.
This repository contains a functional proof-of-concept exploit for CVE-2026-58116, demonstrating remote code execution in LLaMA-Factory WebUI via the `trust_remote_code` parameter. The exploit leverages Hugging Face `transformers` to execute arbitrary Python code when loading a malicious model repository.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H