The llm CLI tool, version 0.27.1, contains a vulnerability that allows arbitrary code execution. The tool accepts user‑supplied Python code through the --functions argument, which is passed directly to the exec() function without any sanitization or sandboxing. An attacker can create a malicious llm command line that includes arbitrary Python code in the --functions option and trick a user into running it, granting the attacker full control over the victim’s system.

The affected product is the llm command‑line interface from github.com/simonw/llm, specifically any installation of version 0.27.1 or earlier that still includes the vulnerable code injection logic. No other vendors or product versions are known to be affected.

Because exec() evaluates code at runtime, the vulnerability provides a direct path to complete arbitrary code execution. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog. However, the lack of sanitization and the reliance on exec() mean the exploitability is high, especially when combined with a social‑engineering prompt that convinces a user to run the crafted command. The primary attack vector is a user executing a malicious llm command, and the scope of impact spans the operating system level of the victim machine.