Junglewise Threat Intelligence

CVE-2025-53002: PYSEC-2026-1576 - LLaMA-Factory allows Code Injection through improper vhead_file safeguards

CVE-2025-53002 · Severity: low · CVSS 3.1 · Published 2026-07-07

Technologies: llamafactory (PyPI). Vendors: PyPI.

Executive brief

LLaMA-Factory allows Code Injection through improper vhead_file safeguards

Affected products

PyPI llamafactory

Related threats

PYSEC-2026-1573 - LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities
PYSEC-2026-1574 - LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py
PYSEC-2026-1575 - LLama Factory Remote OS Command Injection Vulnerability