LLama Factory Remote OS Command Injection Vulnerability

Root

Cause

LLaMA Factory versions 0.9.0 and earlier contain a critical remote OS command injection vulnerability in the training process. The root cause is the insecure use of Python's Popen function with shell=True combined with unsanitized user input. Specifically, the output_dir value, derived directly from user-provided data, is passed into a command string executed by Popen. This allows an attacker to inject arbitrary OS commands by crafting malicious input [1][4].

Attack

Vector

The vulnerability can be exploited remotely without authentication. The proof-of-concept script demonstrates sending a specially crafted request to the target server's web interface (typically running on port 7861). The attacker only needs network access to the LLaMA Factory instance and can inject commands via the training parameters [2][4].

Impact

Successful exploitation enables arbitrary OS command execution on the host system. An attacker can execute any command, potentially compromising sensitive data, escalating privileges, deploying malware, or creating persistent backdoors. This poses a significant risk of data breaches and operational disruption [3][4].

Mitigation

The vulnerability is fixed in LLaMA Factory version 0.9.1. Users are strongly advised to upgrade immediately. The fix involves sanitizing user input and avoiding the use of shell=True in the Popen call [1][3].