CVE-2025-46567 LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

What is CVE-2025-46567?

CVE-2025-46567 is a medium-severity unsafe deserialization vulnerability in hiyouga LLaMA-Factory, published on 1 May 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

LLama Factory enables fine-tuning of large language models. Prior to version 1.0.0, a critical vulnerability exists in the `llamafy_baichuan2.py` script of the LLaMA-Factory project. The script performs insecure deserialization using `torch.load()` on user-supplied `.bin` files from an input directory. An attacker can exploit this behavior by crafting a malicious `.bin` file that executes arbitrary commands during deserialization. This issue has been patched in version 1.0.0.

Weakness: CWE-502

Which versions are affected by CVE-2025-46567?

3 open source packages ship an affected version, including llamafactory. It affects 1 product.

Products include Hiyouga Llama-Factory.

How do I fix CVE-2025-46567?

Upgrade llamafactory to 0.9.3 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-46567 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46567 exists.

Other vulnerabilities in hiyouga LLaMA-Factory

• CVE-2026-58116 LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path Critical 9.3
• CVE-2025-53002 LLaMA-Factory Remote Code Execution (RCE) Vulnerability High 8.3
• CVE-2025-61784 LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities High 7.6
• CVE-2024-52803 LLama Factory Remote OS Command Injection Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f2f7-gj54-6vpv, PYSEC-2026-1574.