CVE-2026-58116: LLaMA Factory RCE — HIGH

CISO Take

LLaMA-Factory's WebUI lets any user with Chat or Training access supply a free-text 'model path' that the code passes straight into Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() calls with trust_remote_code=True hardcoded — meaning a malicious Hugging Face repo or local path can plant arbitrary Python that executes with the privileges of the server process, no exploit chaining or user interaction required beyond having WebUI access. This is a full CIA-high, network-exploitable RCE (CVSS 8.8) in a widely-used LLM fine-tuning framework that many organizations run as an internal self-serve tool for data scientists and ML engineers, often with broad network reach into training data and model artifacts; EPSS currently sits low at 0.5% (top 61st percentile), there's no public exploit or Nuclei template yet, and it's not in CISA KEV, so this is not being mass-exploited today, but the trust_remote_code pattern is a well-understood attack primitive against Hugging Face-based tooling. Treat any LLaMA-Factory instance (through 0.9.5) reachable by non-fully-trusted users as compromised-by-design until patched: upgrade past 0.9.5, hard-disable trust_remote_code or restrict model paths to an allowlist of vetted local models, and put the WebUI behind authentication and network segmentation rather than exposing it broadly to internal users or the internet.

Sources: NVD EPSS ATLAS

What is the risk?

High severity (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) with full confidentiality, integrity, and availability impact — an attacker only needs low-privilege WebUI access and no user interaction to achieve arbitrary code execution. Current real-world exploitation signal is modest: EPSS is low (0.00497, top 61% percentile), there is no CISA KEV listing, no public PoC, and no Nuclei scanner coverage, so this reads as high-severity-but-not-yet-weaponized. However, the underlying primitive — hardcoded trust_remote_code=True combined with unsanitized user-supplied model paths — is a textbook, well-documented RCE pattern in Hugging Face-based tooling that requires only moderate attacker skill to reproduce, so exploitation likelihood should be expected to rise once a working exploit is published (a gist PoC and a VulnCheck advisory already exist as references).

How does the attack unfold?

Initial Access

Attacker with any level of authenticated access to the LLaMA-Factory WebUI (Chat or Training tab) submits a model path field they control.

AML.T0011.000

Malicious Artifact Staging

Attacker hosts a Hugging Face repository (or local path) containing custom modeling/tokenizer code with an embedded malicious payload.

AML.T0010.003

Code Execution

The backend passes the unsanitized model path to AutoTokenizer/AutoModel.from_pretrained() with trust_remote_code=True hardcoded, causing transformers to fetch and execute the attacker's Python code.

AML.T0050

Impact

Attacker achieves arbitrary code execution with the privileges of the server process, enabling data theft, lateral movement, or persistence within the training environment.

AML.T0048

Initial Access

Attacker with any level of authenticated access to the LLaMA-Factory WebUI (Chat or Training tab) submits a model path field they control.

AML.T0011.000

Malicious Artifact Staging

Attacker hosts a Hugging Face repository (or local path) containing custom modeling/tokenizer code with an embedded malicious payload.

AML.T0010.003

Code Execution

The backend passes the unsanitized model path to AutoTokenizer/AutoModel.from_pretrained() with trust_remote_code=True hardcoded, causing transformers to fetch and execute the attacker's Python code.

AML.T0050

Impact

Attacker achieves arbitrary code execution with the privileges of the server process, enabling data theft, lateral movement, or persistence within the training environment.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LLaMA Factory	pip	—	No patch

Do you use LLaMA Factory? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade LLaMA-Factory beyond the vulnerable range as soon as a patched release addressing this trust_remote_code handling is available; track the vendor advisory and GitHub repo for a fix. Until patched: hardcode trust_remote_code=False or remove the parameter entirely for any user-facing model-loading path, and restrict the 'model path' field in Chat/Training interfaces to a server-side allowlist of pre-approved, locally-cached model directories rather than accepting arbitrary Hugging Face repo IDs or filesystem paths. Place the WebUI behind authentication, network segmentation, and least-privilege service accounts so a compromised WebUI process cannot reach sensitive training data or other internal systems; run the WebUI/training process in a sandboxed container with minimal filesystem and network egress. For detection, monitor for unexpected outbound connections to Hugging Face Hub or unfamiliar model repositories, unexpected child processes spawned by the Python process hosting LLaMA-Factory, and audit WebUI logs for anomalous or unfamiliar model path strings submitted by users.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Framework Model Training Data AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.5 - AI system operation and monitoring

NIST AI RMF

GOVERN 6.1 - Third-party risk policies and procedures

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-58116?

LLaMA-Factory's WebUI lets any user with Chat or Training access supply a free-text 'model path' that the code passes straight into Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() calls with trust_remote_code=True hardcoded — meaning a malicious Hugging Face repo or local path can plant arbitrary Python that executes with the privileges of the server process, no exploit chaining or user interaction required beyond having WebUI access. This is a full CIA-high, network-exploitable RCE (CVSS 8.8) in a widely-used LLM fine-tuning framework that many organizations run as an internal self-serve tool for data scientists and ML engineers, often with broad network reach into training data and model artifacts; EPSS currently sits low at 0.5% (top 61st percentile), there's no public exploit or Nuclei template yet, and it's not in CISA KEV, so this is not being mass-exploited today, but the trust_remote_code pattern is a well-understood attack primitive against Hugging Face-based tooling. Treat any LLaMA-Factory instance (through 0.9.5) reachable by non-fully-trusted users as compromised-by-design until patched: upgrade past 0.9.5, hard-disable trust_remote_code or restrict model paths to an allowlist of vetted local models, and put the WebUI behind authentication and network segmentation rather than exposing it broadly to internal users or the internet.

Is CVE-2026-58116 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-58116, increasing the risk of exploitation.

How to fix CVE-2026-58116?

Upgrade LLaMA-Factory beyond the vulnerable range as soon as a patched release addressing this trust_remote_code handling is available; track the vendor advisory and GitHub repo for a fix. Until patched: hardcode trust_remote_code=False or remove the parameter entirely for any user-facing model-loading path, and restrict the 'model path' field in Chat/Training interfaces to a server-side allowlist of pre-approved, locally-cached model directories rather than accepting arbitrary Hugging Face repo IDs or filesystem paths. Place the WebUI behind authentication, network segmentation, and least-privilege service accounts so a compromised WebUI process cannot reach sensitive training data or other internal systems; run the WebUI/training process in a sandboxed container with minimal filesystem and network egress. For detection, monitor for unexpected outbound connections to Hugging Face Hub or unfamiliar model repositories, unexpected child processes spawned by the Python process hosting LLaMA-Factory, and audit WebUI logs for anomalous or unfamiliar model path strings submitted by users.

What systems are affected by CVE-2026-58116?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, agent frameworks.

What is the CVSS score for CVE-2026-58116?

CVE-2026-58116 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingagent frameworks

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.5

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Exploitation Scenario

An attacker who holds (or has phished/stolen) low-privilege credentials to an internally-hosted LLaMA-Factory WebUI publishes a Hugging Face model repository containing custom modeling/tokenizer code with an embedded malicious payload (e.g., a reverse shell or credential harvester triggered on import). The attacker then submits that repository's identifier as the 'model path' in either the Chat or Training tab; the backend passes this unsanitized string directly to AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with trust_remote_code=True hardcoded, causing the transformers library to download and execute the attacker's remote Python code with the privileges of the LLaMA-Factory server process. The attacker now has a foothold on the host running the fine-tuning pipeline, from which they can exfiltrate training data, steal model checkpoints, pivot to adjacent infrastructure, or establish persistence.

Weaknesses (CWE)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-829 Inclusion of Functionality from Untrusted Control Sphere CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.