CVE-2026-58116: Hiyouga Llama-Factory RCE Vulnerability

CVE-2026-58116 Overview

CVE-2026-58116 is a remote code execution vulnerability in LLaMA-Factory through version 0.9.5. The flaw allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied input directly into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True parameter. This causes the Hugging Face transformers library to fetch and execute arbitrary code from a remote or local model repository with the privileges of the server process. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Unauthenticated network attackers can achieve arbitrary Python code execution on the LLaMA-Factory server, leading to full compromise of the host and any connected model training pipelines.

Affected Products

Hiyouga LLaMA-Factory versions through 0.9.5
LLaMA-Factory WebUI Chat interface
LLaMA-Factory WebUI Training interface

Discovery Timeline

2026-06-30 - CVE-2026-58116 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58116

Vulnerability Analysis

LLaMA-Factory exposes a Gradio-based WebUI that accepts a model path parameter for both chat inference and training workflows. When a user submits a model identifier, the application forwards this string into the Hugging Face transformers loader functions without validation or sanitization. The loader is invoked with trust_remote_code=True, which instructs transformers to execute any Python code shipped alongside model weights in the repository.

An attacker who can reach the WebUI can host a malicious repository containing a custom configuration_*.py or modeling_*.py file. When the victim server loads the specified path, transformers imports and executes the attacker-controlled module. Because there is no allowlist or signature verification, any code the attacker embeds runs in the server context.

Root Cause

The root cause is unsafe use of the trust_remote_code=True flag combined with unvalidated user input. Hugging Face documents that this flag should never be enabled for untrusted input, yet LLaMA-Factory hardcodes it. This eliminates the sandbox boundary that would otherwise prevent remote model repositories from executing arbitrary code on the loading host.

Attack Vector

The attack vector is network-based and requires no authentication when the WebUI is exposed. An attacker publishes a malicious model repository on Hugging Face Hub or hosts one on an attacker-controlled server. The attacker then submits the model path through the Chat or Training UI. Upon loading, transformers pulls the repository and executes the embedded Python payload with the privileges of the LLaMA-Factory process, which often runs with GPU and filesystem access.

Refer to the VulnCheck Advisory on Llama Factory and the GitHub Gist PoC Code for technical details on the exploitation path.

Detection Methods for CVE-2026-58116

Indicators of Compromise

Outbound HTTPS connections from the LLaMA-Factory host to unfamiliar Hugging Face repositories or arbitrary domains initiated by the Python process
Presence of unexpected configuration_*.py, modeling_*.py, or tokenizer_*.py files in the Hugging Face cache directory (typically ~/.cache/huggingface/)
Python subprocesses spawning shells, curl, wget, or reverse-shell binaries under the LLaMA-Factory service account
Modifications to model cache directories immediately following WebUI requests containing user-supplied model paths

Detection Strategies

Monitor process trees where the LLaMA-Factory Python interpreter spawns non-Python child processes such as /bin/sh, bash, or nc
Inspect WebUI HTTP request logs for model path parameters pointing to unverified or attacker-controlled namespaces
Alert on file writes to Hugging Face cache paths that contain executable Python modules originating from external repositories
Correlate WebUI activity with new outbound network connections from the training server

Monitoring Recommendations

Enable audit logging on the LLaMA-Factory host to capture process execution, network egress, and file writes under the service account
Baseline normal model loading behavior and alert on deviations such as new repository origins or unusual child processes
Forward Gradio access logs and Python application logs to a central SIEM for correlation with endpoint telemetry

How to Mitigate CVE-2026-58116

Immediate Actions Required

Restrict WebUI network exposure by binding LLaMA-Factory to localhost or an internal management network and placing it behind an authenticating reverse proxy
Run the LLaMA-Factory service under a dedicated unprivileged account with no access to sensitive credentials or production data
Audit the Hugging Face cache directory for unauthorized or unexpected model repositories and remove any suspicious entries
Block outbound network access from the training host to arbitrary domains, allowlisting only trusted model registries

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-58116. Users should monitor the VulnCheck Advisory on Llama Factory and the LLaMA-Factory project for a fixed release that removes the hardcoded trust_remote_code=True behavior or introduces an allowlist for model paths.

Workarounds

Deploy LLaMA-Factory inside an isolated container or virtual machine with no access to production networks, secrets, or credentials
Manually pre-download and validate trusted models, then restrict the WebUI to reference only those local paths
Apply a local patch that removes or defaults trust_remote_code to False in calls to AutoTokenizer.from_pretrained() and AutoModel.from_pretrained()
Front the WebUI with authentication and network access controls to prevent unauthenticated model path submission

bash

# Example: restrict LLaMA-Factory WebUI to localhost and run under an isolated user
sudo useradd -r -s /usr/sbin/nologin llamafactory
sudo -u llamafactory GRADIO_SERVER_NAME=127.0.0.1 \
    python src/train_web.py

# Block outbound egress except to trusted registries (example iptables rule)
sudo iptables -A OUTPUT -m owner --uid-owner llamafactory \
    -d huggingface.co -j ACCEPT
sudo iptables -A OUTPUT -m owner --uid-owner llamafactory -j REJECT