CVE Wiki Pixee · CVE intelligence
← All CVEs

CVE-2026-58116

Critical · CVSS 9.8

LLaMA-Factory — Remote Code Execution via unvalidated user-supplied model path with trust_remote_code=True

CVSS
9.8
nvd
EPSS
—
KEV
No
Class
oss containerizable
CWE-94, CWE-829

Description

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Search profile — drives PoC discovery

Symbols AutoTokenizer.from_pretrainedAutoModel.from_pretrainedtrust_remote_code=Truemodel_pathfrom_pretrainedWebUIChatTraining
Keywords CVE-2026-58116LLaMA-FactoryLLaMA-Factory RCELLaMA-Factory WebUI remote code executiontrust_remote_code exploitAutoTokenizer from_pretrained RCEAutoModel from_pretrained malicious model pathLLaMA-Factory model path injectionllama factory 0.9.5 vulnerabilityCWE-94 LLaMA-FactoryCWE-829 LLaMA-Factory
Versions: through 0.9.5

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-15T00:00:20.000Z · profiled 2026-07-15T00:30:20.000Z