LLaMA-Factory allows Code Injection through improper vhead_file safeguards

The impact of this vulnerability is severe. An attacker can gain complete control over the affected system by injecting malicious code through the Checkpoint path parameter. This could lead to data exfiltration, system compromise, and potential lateral movement within the network. The lack of awareness during exploitation further exacerbates the risk, as the attacker can operate undetected for an extended period. The vulnerability's reliance on the WebUI interface makes it accessible to attackers with minimal interaction, significantly broadening the potential attack surface. The absence of the weightsonly=True parameter during vheadfile loading is the direct cause, allowing arbitrary code execution.

Organizations and individuals utilizing llamafactory for machine learning model training, particularly those running versions 0.9.3 or earlier, are at significant risk. This includes researchers, developers, and companies deploying llamafactory in production environments. Shared hosting environments where llamafactory is installed could also be vulnerable if the hosting provider hasn't applied the necessary updates.

• python / llamafactory:

import os
import subprocess

def check_llamafactory_version():
    try:
        result = subprocess.check_output(['llamafactory', '--version'], stderr=subprocess.STDOUT, text=True)
        version = result.strip()
        if version <= '0.9.3':
            print(f"Vulnerability detected: llamafactory version {version} is vulnerable.")
        else:
            print(f"llamafactory version {version} is patched.")
    except FileNotFoundError:
        print("llamafactory not found.")
    except subprocess.CalledProcessError as e:
        print(f"Error checking version: {e}")

check_llamafactory_version()

• generic web:

curl -I http://your-llamafactory-server/WebUI/checkpoint | grep -i 'checkpoint path'

• generic web: Check access logs for requests containing unusual or long Checkpoint path parameters.

1. 2025-06-27Disclosure

   disclosure

2. 2025-06-27Patch

   patch

1. Gereserveerd2025-06-24
2. Gepubliceerd2025-06-27
3. EPSS bijgewerkt2026-03-23

The primary mitigation is to immediately upgrade to llamafactory version 0.9.4 or later, which addresses the insecure file loading. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the WebUI interface to trusted users only. Implement input validation on the Checkpoint path parameter to prevent malicious input. Monitor system logs for suspicious activity related to file loading and execution. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests. After upgrading, confirm the fix by attempting to load a checkpoint with a deliberately crafted, but harmless, path to verify that the weights_only=True parameter is now enforced.