Executive brief
The llm command-line tool, used for interacting with large language models, contains a security flaw that allows for unauthorized code execution. An attacker could trick a user into running a specific command that includes malicious Python code, leading to a full takeover of the user's computer. This risk is particularly high for developers or researchers who frequently use this tool for AI experimentation.
Technical details
A code injection vulnerability (CWE-94) exists in the llm CLI tool through version 0.27.1. The vulnerability is located in the handling of the '--functions' command-line argument, which is designed to accept custom Python function definitions. The tool uses the unsafe 'exec()' function to process this input without any sanitization or sandboxing. While some CVSS assessments label this as a network-based attack, it practically requires local execution via social engineering (User Interaction). An attacker who successfully tricks a user into executing a crafted command can achieve arbitrary code execution with the privileges of the user running the tool. Red Hat has noted that while Fedora is affected, OpenShift AI is not.
Affected products
- simonw llm thru 0.27.1
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: NVD Published Date