LLaMA Factory Remote OS Command Injection Vulnerability (CVE-2024-52803)
A critical remote OS command injection vulnerability was identified in LLaMA Factory versions 0.9.0 and earlier, caused by unsafe use of the Popen function with shell=True and unsanitized user input. Attackers could execute arbitrary OS commands on affected systems by exploiting the output_dir parameter in the training process. The vulnerability was patched in version 0.9.1.
What happened
A critical remote OS command injection vulnerability was identified in LLaMA Factory versions 0.9.0 and earlier. The vulnerability arose from improper handling of user input in the training process, where the output_dir value was injected into the Popen function without sanitization, and Popen was invoked with shell=True, enabling arbitrary OS command execution.
The vulnerable code was located in the _launch method in src/llamafactory/webui/runner.py, where unsanitized user input was passed directly into a shell command. A proof-of-concept exploit was published demonstrating the ability to execute arbitrary commands on affected systems.
Reported impact
Exploitation of this vulnerability allows attackers to execute arbitrary OS commands on the server, potentially compromise sensitive data, escalate privileges, deploy malware, or create persistent backdoors in the system.
Index analysis
The root cause was the unsafe use of Popen with shell=True combined with unsanitized user input from the output_dir parameter in the training process configuration.
Governance controls
The vulnerability was patched in version 0.9.1 by modifying the _launch method to pass the command and its arguments as a list instead of using shell=True, preventing user inputs from being executed as part of a shell command.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.