the vulnerability in whichllm before version 0.5.16 allows a malicious GGUF filename containing double quotes or other special characters to break out of a generated string literal and execute arbitrary code on the victim’s machine. the injection occurs during the script generation step in cli.py, where HuggingFace‑derived values are interpolated directly into Python source without escaping, leading to remote code execution before any model download occurs. the weakness is classified as CWE‑94: Improper Syntax Checking for Code Injection

the affected product is whichllm from vendor Andyyyy64, affecting all installations with a version earlier than 0.5.16

the CVSS score of 8.6 indicates high severity, and the lack of an EPSS score means the exploit probability is not quantified. because the vulnerability requires a remote attacker to control a HuggingFace repository, the attack vector is indirect but feasible for malicious repository authors. the vulnerability is not listed in CISA KEV, yet it can be exploited by any user executing run or snippet commands with a crafted repository.