Junglewise Threat Intelligence

CVE-2025-46567: PYSEC-2026-1574 - LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

CVE-2025-46567 · Severity: low · CVSS 3.1 · Published 2026-07-07

Technologies: llamafactory (PyPI). Vendors: PyPI.

Executive brief

LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

Affected products

PyPI llamafactory

Related threats

PYSEC-2026-1573 - LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities
PYSEC-2026-1576 - LLaMA-Factory allows Code Injection through improper vhead_file safeguards
PYSEC-2026-1575 - LLama Factory Remote OS Command Injection Vulnerability