Unvalidated model path input in the WebUI of LLaMA-Factory allows a remote attacker with WebUI access to chain the AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() calls with a hardcoded trust_remote_code=True parameter, causing the Hugging Face transformers library to fetch and execute arbitrary Python code from a remote or local model repository. This gives the attacker the full privileges of the server process, leading to complete system compromise.

The vulnerability affects the hiyouga LlamaFactory product up to and including version 0.9.5. No other releases were listed as impacted.

The CVSS score of 9.3 marks this flaw as critical, and the lack of an EPSS score means the likelihood of exploitation is undetermined. The vulnerability is not present in the CISA KEV catalog, but attackers only need WebUI access and can supply an arbitrary model path to trigger the exploit. The exploitation path is straightforward and does not require additional privileges beyond those granted by the WebUI.