Loading vulnerability…
RCE in LLaMA-Factory WebUI model loading
CVE-2026-58116 is a remote code execution vulnerability affecting LLaMA-Factory through version 0.9.5. In the WebUI Chat and Training interfaces, attacker-controlled model path input is passed without validation into Hugging Face transformers loading functions, specifically AutoTokenizer.from_pretrained() and AutoModel.from_pretrained(). The vulnerable code path hardcodes trust_remote_code=True, which allows transformers to fetch and execute Python code from the referenced remote or local model repository. As a result, an attacker with WebUI access can supply a malicious model path and cause arbitrary Python code to execute on the server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary Python code execution with the privileges of the server process running LLaMA-Factory. This can enable full compromise of the application context, including unauthorized access to data available to the process, modification of models or application state, installation of persistence mechanisms, and potential lateral movement depending on the server's privileges and environment.
If you can’t patch tonight, do this now.
Until a patched release is deployed, restrict WebUI access to authorized users only or disable untrusted WebUI exposure entirely. Prevent users from supplying arbitrary model paths in Chat and Training workflows. Where operationally feasible, disable trust_remote_code and only allow loading of vetted local models or trusted repositories.
Patch, then assume compromise.
Upgrade LLaMA-Factory to a fixed release newer than 0.9.5 once available. In addition, modify the application to validate and sanitize all user-supplied model path input before passing it to transformers loading functions. Remove or avoid use of trust_remote_code=True for untrusted model sources wherever possible.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.