Critical RCE in LLaMA-Factory WebUI via Malicious Model Path
A critical remote code execution vulnerability, tracked as CVE-2026-58116, affects LLaMA-Factory through version 0.9.5. The flaw is in the WebUI Chat and Training interfaces, where user-supplied Model path input is passed to Hugging Face model-loading functions with trust_remote_code=True, allowing attacker-controlled code from a remote or local model repository to run with the privileges of the server process. Public reporting said the issue is remotely exploitable and carries a CVSS 3.1 score of 9.8 and CVSS 4.0 score of 9.3.
The vulnerability was publicly described as a model path injection issue that can be triggered by pointing the WebUI at a malicious Hugging Face repository containing crafted Python files executed during model loading. Reports said there is no UI option or configuration setting to disable the unsafe behavior in affected versions, expanding exposure across both interfaces. Recommended mitigations include updating LLaMA-Factory, sanitizing model path input, disabling trust_remote_code where possible, and restricting WebUI access to authorized users only.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
1 event from the most recent confirmed update back to the earliest known activity.
CVE-2026-58116 disclosed for LLaMA-Factory WebUI RCE
A critical remote code execution vulnerability affecting LLaMA-Factory through version 0.9.5 was publicly disclosed as CVE-2026-58116. The flaw allows attacker-controlled model path input in the WebUI Chat and Training interfaces to trigger arbitrary Python code execution via Hugging Face model loading with trust_remote_code enabled.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical vLLM Multimodal Endpoint Flaw Enables Pre-Auth Remote Code Execution via Malicious Video
**CVE-2026-22778** is a critical vulnerability in *vLLM* (an LLM inference/serving engine) that can enable **remote code execution (RCE)** when a server processes attacker-supplied multimodal content (e.g., a crafted video/image payload). The issue stems from vLLM returning a **PIL error** to the client when an invalid image is submitted to a multimodal endpoint, which **leaks a heap address** and dramatically weakens ASLR (reported as reducing brute-force from billions of guesses to ~8). This information disclosure can then be chained with a **heap overflow** in the **JPEG2000 decoder** within bundled **OpenCV/FFmpeg** components to hijack execution flow and run arbitrary commands on the host. Operational risk is elevated because many **default vLLM deployments** (including common `pip`/Docker installs) may be exposed without authentication, and reporting indicates exploitation may still be possible **pre-auth** even when API keys are enabled (via an “invocations” route). The vulnerability affects versions **0.8.3 through < 0.14.1** and is **fixed in vLLM 0.14.1**; remediation should prioritize upgrading to `>= 0.14.1` and reviewing exposure of multimodal endpoints, especially any internet-accessible instances.
Jul 1, 2026
High-Severity Flaws in Langflow and vLLM Expose Secrets and Enable RCE
Two high-severity vulnerabilities were disclosed in widely used AI application components, affecting **Langflow** and **vLLM**. In Langflow, `CVE-2026-33497` impacts versions before **1.7.1** and stems from improper filtering of `folder_name` and `file_name` in the `/profile_pictures/{folder_name}/{file_name}` endpoint. The path traversal flaw (`CWE-22`) allows unauthenticated attackers to read files across directories, including the application's `secret_key`, creating a direct risk of secret exposure and follow-on compromise. The issue is addressed in **Langflow 1.7.1** and tracked in GitHub advisory `GHSA-ph9w-r52h-28p7`. A separate flaw in vLLM, `CVE-2026-27893`, can lead to **remote code execution** by bypassing a user's attempt to disable remote code trust. In versions from **0.10.1** up to but not including **0.18.0**, two model implementation files hardcoded `trust_remote_code=True`, overriding the safer `--trust-remote-code=False` setting and allowing malicious model repositories to run code during model use. The vulnerability, classified as `CWE-693`, was patched in **vLLM 0.18.0**, underscoring supply-chain and configuration-bypass risks in AI infrastructure components.
Jun 29, 2026
Critical Vulnerabilities in Open WebUI Enable Remote Code Execution and Token Theft
Security researchers have identified a critical vulnerability in Open WebUI, a self-hosted enterprise interface for large language models (LLMs), that allows attacker-controlled model servers to inject malicious code into enterprise environments. The flaw, tracked as CVE-2025-64496, stems from insecure handling of Server-Sent Events (SSE) when connecting to external model endpoints via the "Direct Connections" feature. Exploiting this vulnerability, attackers can execute arbitrary JavaScript in the browser context, steal JSON Web Tokens (JWTs), and, in some cases, escalate privileges to achieve remote code execution (RCE) on backend servers, potentially compromising entire AI workloads and sensitive enterprise data. The vulnerability affects Open WebUI versions up to and including 0.6.34 and has been addressed in version 0.6.35. Attackers can leverage the flaw by convincing users to connect to a malicious model endpoint, often under the guise of a "free GPT-4 alternative." Once exploited, the attacker gains persistent access to the victim's AI workspace, documents, chats, and embedded API keys. Security experts strongly recommend that organizations using Open WebUI update to the latest version immediately to mitigate the risk of exploitation and prevent unauthorized access to their AI infrastructure.
Jun 29, 2026