CVE-2025-53002: Llama-Factory RCE Vulnerability

CVE-2025-53002 Overview

CVE-2025-53002 is a critical remote code execution vulnerability affecting LLaMA-Factory, a popular tuning library for large language models. The vulnerability exists in versions up to and including 0.9.3 and allows malicious actors to execute arbitrary code on the host system during the LLaMA-Factory training process. The attack vector involves passing a malicious Checkpoint path parameter through the WebUI interface, exploiting the insecure loading of the vhead_file without proper safeguards.

Critical Impact
Attackers can achieve full remote code execution on systems running vulnerable LLaMA-Factory versions by exploiting insecure deserialization in the model checkpoint loading functionality. The attack is stealthy and victims remain unaware of exploitation.

Affected Products

hiyouga llama-factory versions up to and including 0.9.3
LLaMA-Factory WebUI interface
Systems using LLaMA-Factory for model training and fine-tuning

Discovery Timeline

June 26, 2025 - CVE-2025-53002 published to NVD
September 02, 2025 - Last updated in NVD database

Technical Details for CVE-2025-53002

Vulnerability Analysis

This vulnerability stems from Python's torch.load() function being called without the weights_only=True security parameter when loading checkpoint files. By default, torch.load() uses Python's pickle module for deserialization, which can execute arbitrary code embedded in malicious pickle files. An attacker can craft a malicious checkpoint file containing embedded Python code that executes when the file is loaded during the training process.

The attack is particularly dangerous because it occurs during legitimate model training workflows, making detection difficult. The victim simply needs to load a checkpoint from an attacker-controlled path, which could be achieved through social engineering or by compromising model repositories.

Root Cause

The root cause is the insecure use of torch.load() without the weights_only=True parameter in the vhead_file loading logic. When weights_only is not set to True, PyTorch's load function uses pickle deserialization which can execute arbitrary Python code embedded in the serialized data. This is a well-known attack vector in machine learning frameworks where model files are loaded from untrusted sources.

The vulnerability affects two key locations in the codebase:

src/llamafactory/model/model_utils/valuehead.py - Value head weight loading
src/llamafactory/train/callbacks.py - Training checkpoint loading

Attack Vector

The attack leverages the WebUI interface to pass a malicious checkpoint path. An attacker prepares a specially crafted checkpoint file containing malicious pickle payload and tricks the victim into loading this checkpoint during model training. The exploitation requires network access to the WebUI but no authentication, making it exploitable over the network with low attack complexity.

python

# Vulnerable code pattern (before fix)
# Source: src/llamafactory/model/model_utils/valuehead.py
try:
    vhead_file = cached_file(filename=V_HEAD_WEIGHTS_NAME, **kwargs)
    return torch.load(vhead_file, map_location="cpu")  # Vulnerable: missing weights_only=True
except Exception as err:
    err_text = str(err)

Source: GitHub Commit bb7bf51554d4ba8432333c35a5e3b52705955ede

Detection Methods for CVE-2025-53002

Indicators of Compromise

Unexpected process spawning from Python processes running LLaMA-Factory
Network connections initiated by training processes to unusual destinations
Suspicious checkpoint files with unexpected file sizes or modification timestamps
Unusual system calls or file system access patterns during model loading

Detection Strategies

Monitor for torch.load() calls without weights_only=True in application logs
Implement file integrity monitoring on checkpoint directories
Analyze network traffic from LLaMA-Factory WebUI instances for anomalous connections
Deploy endpoint detection to identify code execution patterns during model loading operations

Monitoring Recommendations

Enable verbose logging for LLaMA-Factory training processes
Monitor WebUI access logs for suspicious checkpoint path parameters
Implement behavioral analysis on systems running ML training workloads
Set up alerts for unexpected child process creation during training sessions

How to Mitigate CVE-2025-53002

Immediate Actions Required

Upgrade LLaMA-Factory to version 0.9.4 or later immediately
Audit all checkpoint files currently in use for potential tampering
Restrict network access to the LLaMA-Factory WebUI interface
Only load checkpoint files from trusted and verified sources

Patch Information

The vulnerability has been addressed in LLaMA-Factory version 0.9.4. The fix adds the weights_only=True parameter to all torch.load() calls, preventing arbitrary code execution during deserialization. The security patch is available in the GitHub commit bb7bf51554d4ba8432333c35a5e3b52705955ede. Additional details are available in the GitHub Security Advisory GHSA-xj56-p8mm-qmxj.

Workarounds

If immediate upgrade is not possible, restrict WebUI access to trusted networks only
Implement strict validation of checkpoint file sources before loading
Run LLaMA-Factory training in isolated environments with limited network access
Apply network segmentation to prevent lateral movement if exploitation occurs