CVE-2026-58116 LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path
Attackers with WebUI access can execute arbitrary Python code by supplying a malicious model path, leveraging unsafe remote code execution settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58116?
CVE-2026-58116 is a critical code injection vulnerability in hiyouga LlamaFactory, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.
Which versions are affected by CVE-2026-58116?
It affects 1 product.
Products include Hiyouga Llama-Factory.
How do I fix CVE-2026-58116?
No fix has been published for CVE-2026-58116 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-58116 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58116 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in hiyouga LlamaFactory
- CVE-2025-53002 LLaMA-Factory Remote Code Execution (RCE) Vulnerability
- CVE-2025-61784 LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities
- CVE-2024-52803 LLama Factory Remote OS Command Injection Vulnerability
- CVE-2025-46567 LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py
Sources
Also known as GHSA-mwc7-mf87-v3mf.