LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

Vulnerability

Overview

A critical vulnerability (CVE-2025-46567) exists in the LLaMA-Factory project prior to version 1.0.0, specifically in the llamafy_baichuan2.py script. The script uses torch.load() to deserialize user-supplied .bin files from an input directory without proper validation, leading to insecure deserialization [1][2][3].

Exploitation

An attacker can craft a malicious .bin file that, when loaded by torch.load(), executes arbitrary commands during the deserialization process. The exploit is triggered without authentication or elevated privileges; a user only needs to run the conversion script with the attacker-controlled --input_dir argument, for example by downloading a malicious project folder or cloning a repository containing a crafted .bin file and a config.json [3]. A proof-of-concept demonstrates using a __reduce__ method to execute system commands like mkdir HACKED! [3].

Impact

Successful exploitation results in arbitrary code execution (RCE), which can lead to full system compromise. In shared compute environments, this could enable persistence or lateral movement [3]. The vulnerable line of code is at llamafy_baichuan2.py line 35, where torch.load() is called without additional security measures [4].

Mitigation

The vulnerability has been patched in version 1.0.0 of LLaMA-Factory. Users are strongly advised to update to the latest version. As a temporary workaround, avoid running the llamafy_baichuan2.py script on untrusted .bin files or input directories [1][2][3].