LLaMA-Factory vulnerabilities
5 known vulnerabilities in LLaMA-Factory from Hiyouga. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
LlamaFactory: Improper Control of Generation of Code
LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied mod
- 8.1 High severity
LLaMA-Factory: Server-Side Request Forgery
LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery (SSRF) vulnerability in the chat API allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external n
- 9.8 Critical severity
LLaMA-Factory: Improper Control of Generation of Code
LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file`
- 7.8 High severity
LLaMA-Factory: Deserialization of Untrusted Data
LLama Factory enables fine-tuning of large language models. Prior to version 1.0.0, a critical vulnerability exists in the `llamafy_baichuan2.py` script of the LLaMA-Factory project. The script performs insecure deserialization using `torch.load()` on user-sup
- 9.8 Critical severity
LLaMA-Factory: Improper Neutralization of Special Elements used in an OS Command
LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actor