CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-58116

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.005

EPSS Ranking 40.0%

CVSS Severity

CVSS v3 Score 9.8

References

Products affected by CVE-2026-58116

Hiyouga » Llama-Factory » Version: 0.0.9

cpe:2.3:a:hiyouga:llama-factory:0.0.9
Hiyouga » Llama-Factory » Version: 0.1.0

cpe:2.3:a:hiyouga:llama-factory:0.1.0
Hiyouga » Llama-Factory » Version: 0.1.1

cpe:2.3:a:hiyouga:llama-factory:0.1.1
Hiyouga » Llama-Factory » Version: 0.1.2

cpe:2.3:a:hiyouga:llama-factory:0.1.2
Hiyouga » Llama-Factory » Version: 0.1.3

cpe:2.3:a:hiyouga:llama-factory:0.1.3
Hiyouga » Llama-Factory » Version: 0.1.4

cpe:2.3:a:hiyouga:llama-factory:0.1.4
Hiyouga » Llama-Factory » Version: 0.1.5

cpe:2.3:a:hiyouga:llama-factory:0.1.5
Hiyouga » Llama-Factory » Version: 0.1.6

cpe:2.3:a:hiyouga:llama-factory:0.1.6
Hiyouga » Llama-Factory » Version: 0.1.7

cpe:2.3:a:hiyouga:llama-factory:0.1.7
Hiyouga » Llama-Factory » Version: 0.1.8

cpe:2.3:a:hiyouga:llama-factory:0.1.8
Hiyouga » Llama-Factory » Version: 0.2.0

cpe:2.3:a:hiyouga:llama-factory:0.2.0
Hiyouga » Llama-Factory » Version: 0.2.1

cpe:2.3:a:hiyouga:llama-factory:0.2.1
Hiyouga » Llama-Factory » Version: 0.2.2

cpe:2.3:a:hiyouga:llama-factory:0.2.2
Hiyouga » Llama-Factory » Version: 0.3.0

cpe:2.3:a:hiyouga:llama-factory:0.3.0
Hiyouga » Llama-Factory » Version: 0.3.2

cpe:2.3:a:hiyouga:llama-factory:0.3.2
Hiyouga » Llama-Factory » Version: 0.3.3

cpe:2.3:a:hiyouga:llama-factory:0.3.3
Hiyouga » Llama-Factory » Version: 0.4.0

cpe:2.3:a:hiyouga:llama-factory:0.4.0
Hiyouga » Llama-Factory » Version: 0.5.0

cpe:2.3:a:hiyouga:llama-factory:0.5.0
Hiyouga » Llama-Factory » Version: 0.5.2

cpe:2.3:a:hiyouga:llama-factory:0.5.2
Hiyouga » Llama-Factory » Version: 0.5.3

cpe:2.3:a:hiyouga:llama-factory:0.5.3
Hiyouga » Llama-Factory » Version: 0.6.0

cpe:2.3:a:hiyouga:llama-factory:0.6.0
Hiyouga » Llama-Factory » Version: 0.6.1

cpe:2.3:a:hiyouga:llama-factory:0.6.1
Hiyouga » Llama-Factory » Version: 0.6.2

cpe:2.3:a:hiyouga:llama-factory:0.6.2
Hiyouga » Llama-Factory » Version: 0.6.3

cpe:2.3:a:hiyouga:llama-factory:0.6.3
Hiyouga » Llama-Factory » Version: 0.7.0

cpe:2.3:a:hiyouga:llama-factory:0.7.0
Hiyouga » Llama-Factory » Version: 0.7.1

cpe:2.3:a:hiyouga:llama-factory:0.7.1
Hiyouga » Llama-Factory » Version: 0.8.0

cpe:2.3:a:hiyouga:llama-factory:0.8.0
Hiyouga » Llama-Factory » Version: 0.8.1

cpe:2.3:a:hiyouga:llama-factory:0.8.1
Hiyouga » Llama-Factory » Version: 0.8.2

cpe:2.3:a:hiyouga:llama-factory:0.8.2
Hiyouga » Llama-Factory » Version: 0.8.3

cpe:2.3:a:hiyouga:llama-factory:0.8.3
Hiyouga » Llama-Factory » Version: 0.9.0

cpe:2.3:a:hiyouga:llama-factory:0.9.0
Hiyouga » Llama-Factory » Version: 0.9.1

cpe:2.3:a:hiyouga:llama-factory:0.9.1
Hiyouga » Llama-Factory » Version: 0.9.2

cpe:2.3:a:hiyouga:llama-factory:0.9.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-58116

Products

Pricing

Contact Us