Critical RCE in LLaMA-Factory WebUI via Malicious Model Path

A critical remote code execution vulnerability, tracked as CVE-2026-58116, affects LLaMA-Factory through version 0.9.5. The flaw is in the WebUI Chat and Training interfaces, where user-supplied Model path input is passed to Hugging Face model-loading functions with trust_remote_code=True, allowing attacker-controlled code from a remote or local model repository to run with the privileges of the server process. Public reporting said the issue is remotely exploitable and carries a CVSS 3.1 score of 9.8 and CVSS 4.0 score of 9.3.

The vulnerability was publicly described as a model path injection issue that can be triggered by pointing the WebUI at a malicious Hugging Face repository containing crafted Python files executed during model loading. Reports said there is no UI option or configuration setting to disable the unsafe behavior in affected versions, expanding exposure across both interfaces. Recommended mitigations include updating LLaMA-Factory, sanitizing model path input, disabling trust_remote_code where possible, and restricting WebUI access to authorized users only.