LLaMA-Factory arbitrary code execution via unsafe deserialization
LLaMA-Factory versions up to 0.9.2 contained a vulnerability in the llamafy_baichuan2.py script that allowed arbitrary code execution through unsafe deserialization of user-supplied .bin files. The vulnerability was patched in version 0.9.3 by restricting deserialization to safe tensor loading.
What happened
The llamafy_baichuan2.py script in LLaMA-Factory performed insecure deserialization using torch.load() on user-supplied .bin files from an input directory.
An attacker could exploit this by crafting a malicious .bin file that executes arbitrary commands during deserialization when a user runs the conversion script with an attacker-supplied input directory.
Reported impact
The vulnerability enables arbitrary command execution, system compromise, and potential persistence or lateral movement in shared compute environments.
Index analysis
The vulnerability affected LLaMA-Factory versions 0.9.2 and earlier and was patched in version 0.9.3 by adding the weights_only=True parameter to torch.load().
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.