Executive brief
whichllm is a command-line tool for working with large language models from HuggingFace. A remote attacker who controls a HuggingFace repository can craft a malicious model filename that, when a user runs the `whichllm run` or `whichllm snippet` commands, causes arbitrary code to execute on the user's machine without warning or explicit consent.
Technical details
The vulnerability is a code injection flaw in cli.py affecting the run and snippet commands. The root cause is unsafe string interpolation of HuggingFace Hub API metadata (including GGUF variant filenames from the siblings rfilename field) directly into dynamically generated Python source code. An attacker can inject special characters such as double quotes into the filename to break out of the generated string literal and insert arbitrary Python code. The script is generated and executed before any model download occurs, so the attacker need only control the repository metadata on HuggingFace Hub. The fix (merged August 5, 2026) escapes metadata values using Python's repr() function before embedding them in generated scripts, ensuring special characters cannot alter code structure.
Affected products
- whichllm whichllm before 0.5.16
Timeline
- 2026-08-26: disclosed: CVE-2026-58474 published
- 2026-08-05: patched: Fix merged in commit 77e8dc9 (version 0.5.16 released with escaping fix)