CVE-2024-52803
High
Description
LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on the host system. The issue is caused by insecure usage of the `Popen` function with `shell=True`, coupled with unsanitized user input. Immediate remediation is required to mitigate the risk. This vulnerability is fixed in 0.9.1.
SeverityHigh
CVSS7.5
Exploit probability84. percentile2.3%
ProductHiyouga Llama-factory
PublishedNov 21, 2024
First seenNov 21, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- hiyouga llama-factory0.9.1 or later
- llamafactory0.9.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hiyouga llama-factory | v < 0.9.1 | 0.9.1 |
| llamafactoryPyPI | v < 0.9.1 | 0.9.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.