CVE-2026-58474: whichllm RCE Vulnerability

CVE-2026-58474 Overview

CVE-2026-58474 is a code injection vulnerability [CWE-94] in whichllm versions before 0.5.16. The run and snippet commands generate Python scripts by interpolating HuggingFace-derived metadata directly into source code without escaping. An attacker who controls a HuggingFace repository can craft a malicious GGUF filename containing double quotes or other special characters to break out of the generated string literal and execute arbitrary Python code on the user's machine. Execution occurs before any model download, so victims are compromised simply by targeting a hostile repository with whichllm.

Critical Impact
Remote attackers controlling a HuggingFace repository can achieve arbitrary code execution on user machines before any model file is downloaded.

Affected Products

whichllm versions prior to 0.5.16
whichllm CLI run command
whichllm CLI snippet command

Discovery Timeline

2026-08-26 - CVE-2026-58474 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-58474

Vulnerability Analysis

The vulnerability resides in the script generation function inside src/whichllm/cli.py. The function builds a Python script using an f-string template that embeds untrusted values from the HuggingFace Hub API siblings.rfilename field. Because the values are inserted directly between double quotes without escaping, a filename containing a " character terminates the string literal and allows injected Python statements to follow. The generated script is then executed as part of the run and snippet workflows, giving the attacker code execution in the user's Python environment.

Root Cause

The root cause is unsafe string interpolation of remote, attacker-controlled metadata into generated Python source code. The pre-patch code used filename="{variant.filename}", which trusts that variant.filename contains no quote or escape characters. HuggingFace repository owners fully control the filenames listed in their model repositories, so this data must be treated as untrusted.

Attack Vector

An attacker publishes a HuggingFace repository containing a GGUF file whose name embeds double quotes and Python payload code. When a victim runs whichllm run or whichllm snippet targeting the repository, the CLI queries the HuggingFace Hub API, retrieves the malicious rfilename, and inserts it into the generated script. Executing the script triggers the injected payload prior to any download, resulting in arbitrary code execution on the local host.

python

     """Generate a self-contained Python chat script for any model type."""
     if variant:
         n_gpu = 0 if cpu_only else -1
-        return f'''\
+        return f"""\
 from huggingface_hub import hf_hub_download
 from llama_cpp import Llama
 
-print("Downloading {model.id} ({variant.quant_type})...")
-model_path = hf_hub_download(repo_id="{model.id}", filename="{variant.filename}")
+model_id = {model.id!r}
+filename = {variant.filename!r}
+quant_type = {variant.quant_type!r}
+print(f"Downloading {{model_id}} ({{quant_type}})...")
+model_path = hf_hub_download(repo_id=model_id, filename=filename)
 print("Loading model...")
 llm = Llama(
     model_path=model_path,

Source: GitHub Commit 77e8dc9. The patch replaces raw string interpolation with the !r conversion, which applies repr() to safely escape any special characters in model.id, variant.filename, and variant.quant_type.

Detection Methods for CVE-2026-58474

Indicators of Compromise

Python processes spawned by whichllm run or whichllm snippet that create child shells (sh, bash, cmd.exe, powershell.exe).
Outbound network connections from Python interpreters running whichllm-generated scripts to non-HuggingFace endpoints.
Generated scripts on disk containing GGUF filenames with embedded quote characters or newline sequences.
HuggingFace repository queries returning rfilename values containing ", \n, or Python keywords.

Detection Strategies

Inspect any locally generated whichllm scripts for unexpected code between hf_hub_download and Llama initialization.
Monitor for the installed whichllm package version and flag any host running a version below 0.5.16.
Alert on Python child processes launching interactive shells or writing to autostart locations shortly after whichllm invocation.

Monitoring Recommendations

Log CLI invocations of whichllm alongside the target repo_id for post-incident review.
Capture process ancestry so whichllm → python → shell chains are attributable to a specific repository.
Track HTTP requests to huggingface.co/api/models/* and correlate responses with subsequent script generation events.

How to Mitigate CVE-2026-58474

Immediate Actions Required

Upgrade whichllm to version 0.5.16 or later on every developer, research, and CI host.
Audit recent uses of whichllm run and whichllm snippet and validate the integrity of any HuggingFace repositories that were queried.
Rotate credentials and tokens accessible from environments where vulnerable versions executed against untrusted repositories.

Patch Information

The fix is available in whichllm v0.5.16, landed through pull request #147 and commit 77e8dc9. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict whichllm usage to trusted, first-party HuggingFace repositories until upgrades are complete.
Run whichllm inside disposable, network-restricted containers or virtual machines to contain injected payloads.
Review generated scripts manually before executing them when operating on any pre-0.5.16 installation.

bash

# Upgrade whichllm to the fixed release
pip install --upgrade 'whichllm>=0.5.16'

# Verify installed version
python -m pip show whichllm | grep -i version