Loading story…
Versions of whichllm before 0.5.16 allow arbitrary Python code execution through the run and snippet commands when users select a malicious Hugging Face model repository. The CLI inserted unescaped Hugging Face Hub siblings[].rfilename metadata—including GGUF filenames and model IDs—directly into generated Python scripts, enabling an attacker-controlled filename containing quotes or special characters to terminate a string literal and inject statements before the requested model downloads.
The project fixed the flaw in commit 77e8dc9 (PR #147), released in v0.5.16, by rendering generated metadata with Python representations (!r) rather than placing values in quoted literals. Organizations using whichllm should upgrade to 0.5.16 or later and treat untrusted model repositories and metadata as potentially malicious until updated.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
whichllm commit 77e8dc9 fixed unsafe interpolation of model metadata and GGUF filenames in scripts generated by the `run` and `snippet` commands. The fix uses Python literal representations (`!r`) and adds tests confirming crafted filenames remain data rather than executable code; it is included in v0.5.16.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, tracked as **`CVE-2026-58116`**, affects **LLaMA-Factory** through version **0.9.5**. The flaw is in the WebUI **Chat** and **Training** interfaces, where user-supplied **Model path** input is passed to Hugging Face model-loading functions with **`trust_remote_code=True`**, allowing attacker-controlled code from a remote or local model repository to run with the privileges of the server process. Public reporting said the issue is remotely exploitable and carries a **CVSS 3.1 score of 9.8** and **CVSS 4.0 score of 9.3**. The vulnerability was publicly described as a model path injection issue that can be triggered by pointing the WebUI at a malicious Hugging Face repository containing crafted Python files executed during model loading. Reports said there is no UI option or configuration setting to disable the unsafe behavior in affected versions, expanding exposure across both interfaces. Recommended mitigations include updating LLaMA-Factory, sanitizing model path input, disabling **`trust_remote_code`** where possible, and restricting WebUI access to authorized users only.
Jun 30, 2026
A critical remote code execution flaw in Hugging Face's `transformers` library allowed attacker-controlled model repositories to run arbitrary code during the standard `from_pretrained()` loading process, even when `trust_remote_code=False` was set. The issue was tied to unsafe handling of untrusted model configuration data, including nested configuration resolution in the LightGlue loading path, where values from `config.json` could override the intended safety setting and trigger execution of attacker-supplied Python modules during model initialization. Reports said the vulnerability affected `transformers` versions `4.56.0` through `5.2.x` in environments where the `kernels` package was installed, with version `5.2.0` specifically cited in LightGlue-related exploitation scenarios. Exposed targets included inference servers, research notebooks, CI/CD pipelines, and automated model evaluation systems, where successful compromise could enable theft of cloud credentials, API keys, SSH keys, proprietary datasets, lateral movement, persistence, and backdoor deployment. Hugging Face released a fix in `transformers` `5.3.0` and urged organizations to upgrade and treat model loading as a code execution surface.
Jun 29, 2026
A now-patched remote-code-execution flaw in Unsloth Studio allowed attacker-controlled Hugging Face model repositories to run arbitrary Python code when an operator merely selected a model in the Studio browser interface. The backend inspection workflow enabled `trust_remote_code=True` by default, allowing a crafted `config.json` `auto_map` entry to make Hugging Face Transformers import Python modules supplied by the repository; exploitation did not require loading model weights, starting inference or training, or separately approving remote code execution. The payload ran with the Studio operator's privileges and could expose Hugging Face tokens, cloud credentials, SSH keys, proprietary datasets, and model artifacts. Pillar Security privately reported the issue in early June 2026, and Unsloth fixed it in version `2026.6.9` on June 18; no CVE or public advisory was issued because Studio was in beta. Organizations using Studio should upgrade to `2026.6.9` or later and isolate model-loading workflows from sensitive credentials and resources.
Sep 30, 2026