Executive brief
LLaMA-Factory is a platform used for training and interacting with large language models. A security flaw allows anyone with access to the web interface to take complete control of the server by providing a link to a malicious AI model. This could result in the theft of sensitive training data, unauthorized access to internal systems, or a total service disruption.
Technical details
LLaMA-Factory (up to version 0.9.5) is vulnerable to Remote Code Execution (RCE) due to improper input validation of the 'Model path' field in its WebUI. The application passes user-controlled strings directly into the Hugging Face transformers library functions 'AutoTokenizer.from_pretrained()' and 'AutoModel.from_pretrained()'. Crucially, the application hardcodes the 'trust_remote_code' parameter to 'True'. An attacker can exploit this by providing a path to a malicious model repository (local or on Hugging Face Hub) containing executable Python code in its configuration files. The code is executed with the privileges of the server process without further user interaction.
Affected products
- hiyouga LlamaFactory <= 0.9.5
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory