LLaMA-Factory: model path in the WebUI loads remote code and executes it as the training server process

Impact

The Chat and Training screens pass a user-supplied model path straight into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with trust_remote_code hardcoded to True, so naming a Hugging Face repo or local directory that ships custom modeling code runs that code as the LLaMA-Factory process. On a fine-tuning box this is the account that owns the GPUs, the dataset mounts and any cached credentials for model registries, so the attacker gets the training node and everything it can read. LLaMA-Factory WebUIs are routinely left without their own authentication on an internal port, which is why this is rated as network-reachable with no privileges. Affects versions through 0.9.5.

Who can reach it

Anyone who can reach the LLaMA-Factory WebUI and submit a model path - which in common deployments means any user on the internal network or cluster, since the WebUI ships no authentication of its own. No credentials are required beyond reaching the port; a user who is supposed to have WebUI access can also use it to break out of the application.

What to do

No fixed version is named in the record. Restrict reachability of the WebUI now - bind it to loopback, put it behind an authenticating proxy, and allow only operator-controlled model paths - and run it as an unprivileged account in a container with no access to cluster credentials. Treat WebUI access as equivalent to shell on the training node until upstream removes the hardcoded trust_remote_code. Mitigation is config and network only; no reboot needed.

References

Related entries

• ktransformers: unauthenticated pickle deserialization on the scheduler ZMQ socket gives RCE as the server processCVE-2026-63767 · ktransformers SchedulerServer (ZMQ ROUTER socket)Critical
• MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical
• sentence-transformers: local model directory executes Python despite trust_remote_code=FalseCVE-2026-68770 · sentence-transformers (import_module_class trust_remote_code gate)Critical
• Langchain-Chatchat: unauthenticated /tools/call invokes the shell tool for remote command executionCVE-2026-75128 · Langchain-Chatchat (POST /tools/call API endpoint)Critical
• LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical
• Headroom: client-supplied x-headroom-user-id header is trusted as identity, exposing other users' memoryCVE-2026-77776 · Headroom LLM proxy (x-headroom-user-id header treated as identity)Critical