CVE-2024-52803 LLama Factory Remote OS Command Injection Vulnerability

What is CVE-2024-52803?

CVE-2024-52803 is a high-severity command injection vulnerability in hiyouga LLaMA-Factory, published on 21 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on the host system. The issue is caused by insecure usage of the `Popen` function with `shell=True`, coupled with unsanitized user input. Immediate remediation is required to mitigate the risk. This vulnerability is fixed in 0.9.1.

Weakness: CWE-78, CWE-79

Which versions are affected by CVE-2024-52803?

3 open source packages ship an affected version, including llamafactory. It affects 1 product.

Products include Hiyouga Llama-Factory.

How do I fix CVE-2024-52803?

Upgrade llamafactory to 0.9.1 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-52803 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52803 exists.

Other vulnerabilities in hiyouga LLaMA-Factory

• CVE-2026-58116 LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path Critical 9.3
• CVE-2025-53002 LLaMA-Factory Remote Code Execution (RCE) Vulnerability High 8.3
• CVE-2025-61784 LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities High 7.6
• CVE-2025-46567 LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hj3w-wrh4-44vp, PYSEC-2026-1575.