Unvalidated Model Paths Enable Remote Code Execution in LLaMA-Factory

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

LLaMA-Factory versions through 0.9.5 suffer from a critical remote code execution vulnerability (CVSS 9.8) stemming from improper input validation in model path handling. When users supply a malicious model path through the Chat or Training WebUI interfaces, the application passes this input directly to Hugging Face's AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() functions with trust_remote_code=True hardcoded. This configuration instructs the transformers library to automatically fetch and execute arbitrary Python code from remote sources, effectively converting user-controlled model paths into code execution primitives. Organizations deploying LLaMA-Factory for fine-tuning, inference, or experimentation face immediate risk, particularly when WebUI access is available to untrusted users or exposed on networks.

Casky's 446 mapped security skills detect the attack patterns underlying this vulnerability across multiple MITRE ATT&CK lifecycle stages. During initial access and reconnaissance (TA0001, TA0043), practitioners using Casky's Claude-powered analysis identify suspicious model path inputs and reconnaissance attempts against WebUI endpoints. The execution phase (TA0002) detection focuses on code injection patterns—specifically CWE-94 (Improper Control of Generation of Code) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere)—by flagging unvalidated user inputs flowing directly into code-loading functions. Practitioners would observe findings highlighting the hardcoded trust_remote_code=True parameter as a critical trust boundary violation, model path manipulation attempts, and remote URL fetching behavior that precedes code execution. Extended reasoning capabilities enable Casky to correlate seemingly innocuous model path specifications with known Hugging Face Hub abuse patterns, helping security teams differentiate legitimate model downloads from exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-58116.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-58116

Casky has 446 skills that investigate the attack patterns behind CVE-2026-58116. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn