CVE-2026-58116: LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

Synopsis

Remote code execution in LLaMA-Factory versions through 0.9.5 stems from unsanitized model path input passed directly to Hugging Face transformers library calls with trust_remote_code=True hardcoded. An unauthenticated attacker who can reach the WebUI over the network can supply a malicious model path in the Chat or Training interfaces, causing the server to fetch and execute arbitrary Python code with the privileges of the server process. No patched version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment an upstream fix is available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the LLaMA-Factory WebUI over the network; the vulnerability is exposed on any interface the server process binds to.

• AuthenticationNot required

  No credentials are required; the vulnerable model path input is accessible to any user who can load the WebUI.

• Victim interactionNot required

  No victim action is needed; the attacker submits the malicious model path directly and the server executes it without any user having to click or approve anything.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and requires no race condition, specific memory layout, or other environmental precondition beyond network access to the WebUI.

Blast Radius

• Reads any file or secret accessible to the server process, including model weights, API keys, and environment variables.
• Modifies or deletes files on the host filesystem within the reach of the server process account.
• Establishes persistent access or lateral movement by executing attacker-controlled binaries or shell commands on the server.
• Crashes or degrades the LLaMA-Factory server process, disrupting training and inference workloads.