CVE-2026-112080: Llama-Chinese: code injection via adapter config loader

MEDIUMCISA: TRACK*

Published October 19, 2026

CISO Take

Llama-Chinese's example Gradio chat script passes an attacker-controlled base_model_name_or_path from an adapter config into get_class_from_dynamic_module, which allows remote code injection when a user loads a malicious adapter. The CVSS of 6.3 (medium) and the user-interaction requirement limit the blast radius, but a PoC archive is linked in the project's issue tracker, and the maintainers have not responded. EPSS is low (0.00315, roughly the 77th percentile), the CVE is not in CISA KEV, there is no Nuclei template, and no downstream-dependent data is available, so broad mass exploitation is unlikely. The code is example/demo code on a rolling release with no fixed version, so teams that copied or deployed the script should stop loading third-party adapters through it. Remove or isolate any deployment of examples/chat_gradio_no_merge.py, and only load adapters from trusted, pinned sources.

Sources:NVDEPSSATLASvuldb.com

What is the risk?

Medium overall. The network attack vector, low complexity, and no required privileges are offset by the need for a user to load a malicious adapter and by confidentiality, integrity, and availability impacts rated only low in the CVSS vector. A public proof of concept is referenced in the upstream issue, and the vendor has not responded, so no patch is expected soon. Because the affected code is an example script rather than a packaged library, exposure depends on whether teams deployed it as-is. EPSS is low (0.00315), and the CVE is not in CISA KEV.

How does the attack unfold?

Initial Access

The attacker distributes a malicious adapter config through a model hub or shared link.

AML.T0010.003

User Execution

A user loads the adapter in the Llama-Chinese Gradio chat example.

AML.T0011.000

Exploitation

The crafted base_model_name_or_path reaches get_class_from_dynamic_module and injects code.

AML.T0050

Impact

The attacker runs code on the host and can steal credentials, weights, and data.

Initial Access

The attacker distributes a malicious adapter config through a model hub or shared link.

AML.T0010.003

User Execution

A user loads the adapter in the Llama-Chinese Gradio chat example.

AML.T0011.000

Exploitation

The crafted base_model_name_or_path reaches get_class_from_dynamic_module and injects code.

AML.T0050

Impact

The attacker runs code on the host and can steal credentials, weights, and data.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Llama-Chinese	—	—	No patch

Do you use Llama-Chinese? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) No fixed version exists because the project uses a rolling release; check the upstream issue #371 for any fix. 2) Stop running examples/chat_gradio_no_merge.py with untrusted adapters, or remove the example from production and shared environments. 3) Only load adapter configs from trusted, reviewed sources, and pin them by commit hash. 4) Patch or wrap the loader to reject dynamic module resolution from user-controlled base_model_name_or_path values, and validate the value against an allowlist of known base models. 5) Run model demos in sandboxed containers with minimal privileges, no secrets mounted, and restricted egress. 6) Detect unexpected child processes, outbound connections, or file writes from Gradio and Python inference processes.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainFrameworkModelInferenceAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-112080?

Is CVE-2026-112080 actively exploited?

No confirmed active exploitation of CVE-2026-112080 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-112080?

1) No fixed version exists because the project uses a rolling release; check the upstream issue #371 for any fix. 2) Stop running examples/chat_gradio_no_merge.py with untrusted adapters, or remove the example from production and shared environments. 3) Only load adapter configs from trusted, reviewed sources, and pin them by commit hash. 4) Patch or wrap the loader to reject dynamic module resolution from user-controlled base_model_name_or_path values, and validate the value against an allowlist of known base models. 5) Run model demos in sandboxed containers with minimal privileges, no secrets mounted, and restricted egress. 6) Detect unexpected child processes, outbound connections, or file writes from Gradio and Python inference processes.

What systems are affected by CVE-2026-112080?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Gradio-based ML demo UIs, LoRA/PEFT adapter loading pipelines, Fine-tuned LLM inference.

What is the CVSS score for CVE-2026-112080?

CVE-2026-112080 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

Model servingGradio-based ML demo UIsLoRA/PEFT adapter loading pipelinesFine-tuned LLM inference

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker publishes a LoRA adapter on a public model hub or shares it in a community channel. The adapter's config sets base_model_name_or_path to a value that triggers dynamic module loading of attacker-supplied code. A developer or analyst runs the Llama-Chinese Gradio chat example and loads the adapter. The injected code executes on the host, giving the attacker a foothold to steal API keys, model weights, and data, and to move laterally within the ML environment.

Weaknesses (CWE)

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.