Loading vulnerability…
CVE-2026-58116 is a remote code execution vulnerability affecting LLaMA-Factory through version 0.9.5. In the WebUI Chat and Training interfaces, attacker-controlled model path input is passed without validation into Hugging Face transformers loading functions, specifically AutoTokenizer.from_pretrained() and AutoModel.from_pretrained(). The vulnerable code path hardcodes trust_remote_code=True, which allows transformers to fetch and execute Python code from the referenced remote or local model repository. As a result, an attacker with WebUI access can supply a malicious model path and cause arbitrary Python code to execute on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a functional proof-of-concept exploit for CVE-2026-58116 affecting LLaMA-Factory WebUI <= 0.9.5. The exploit abuses the application's use of Hugging Face transformers with trust_remote_code=True while accepting an attacker-controlled model path. By supplying a malicious Hugging Face model repository or local model directory whose config.json contains auto_map entries pointing to attacker Python modules, arbitrary Python executes on the server during configuration loading. Repository structure is small and purpose-built: README.md explains the vulnerability and exploitation flow; build_and_verify.py is the main entry point that assembles the malicious model directory, verifies the sink locally with AutoConfig.from_pretrained(..., trust_remote_code=True), and optionally uploads the model to the Hugging Face Hub; poc-model/config.json declares the malicious auto_map; poc-model/configuration_poc.py contains the actual payload in PoCConfig.__init__; and poc-model/modeling_poc.py is a minimal stub model class needed for importability. Main exploit capability: remote code execution on the target LLaMA-Factory server as soon as the model/config is loaded, before any model weights are needed. The included payload is intentionally benign but proves arbitrary command execution by printing host details and running the local 'id' command. This is not merely a detector; it is an operational PoC with a working payload, though the payload is basic and hardcoded rather than fully customizable.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.