llamafactory vulnerabilities

CVEs whose affected-version data names the llamafactory package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2025-61784High· 7.6

LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities

▾ Twilightllamafactory · llamafactoryEPSS 0.38%via OSV

CVE-2025-53002High· 8.3

LLaMA-Factory allows Code Injection through improper vhead_file safeguards

LLaMA-Factory allows Code Injection through improper vhead_file safeguards

▾ Twilightllamafactory · llamafactoryEPSS 1.2%via OSV

CVE-2025-46567Medium· 6.1

LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py

▾ Sunlitllamafactory · llamafactoryEPSS 0.27%via OSV

CVE-2024-52803High· 7.5

LLama Factory Remote OS Command Injection Vulnerability

LLama Factory Remote OS Command Injection Vulnerability

▾ Twilightllamafactory · llamafactoryEPSS 2.3%via OSV

llamafactory vulnerabilities (CVEs) · VulnSea