8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53002

CVE-2025-53002: LLaMA-Factory Remote Code Execution (RCE) Vulnerability

LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the vhead_file is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious Checkpoint path parameter through the WebUI interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the vhead_file argument is loaded without the secure parameter weights_only=True. Version 0.9.4 contains a fix for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53002

CVE-2025-53002:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
llamafactory	pip	<= 0.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from unsafe deserialization using torch.load. The advisory highlights that the LLaMA-Factory application loads a vhead_file without the necessary weights_only=True safeguard in the torch.load function. This allows an attacker to craft a malicious model file (value_head.bin) that, when loaded by the application, executes arbitrary code on the server.

The investigation of the provided patch commit, bb7bf51554d4ba8432333c35a5e3b52705955ede, confirms this root cause. The commit applies the same fix—adding weights_only=True to torch.load calls—in two different locations:

load_valuehead_params: This function, located in src/llamafactory/model/model_utils/valuehead.py, is the primary function identified in the vulnerability description. It is called during the Reward Modeling training stage and takes a user-controlled 'Checkpoint path' from the WebUI to load model parameters. The lack of the weights_only=True flag makes it the direct entry point for the described remote code execution attack.
fix_valuehead_checkpoint: This function, found in src/llamafactory/train/callbacks.py, also contained a vulnerable torch.load call that was patched. It handles loading checkpoint files during the training process. While not the main attack vector described, it represents the same fundamental flaw and could be another potential avenue for exploitation.

Both functions would appear in a runtime profile during the exploitation of this vulnerability, as they are directly involved in loading the malicious file that triggers the code execution. The fix applied in the patch effectively mitigates the vulnerability by ensuring that torch.load only deserializes model weights and not arbitrary Python objects.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.