CVE-2024-52803

Advisory

A critical remote OS command injection vulnerability exists in Llama Factory due to improper handling of user input. The insecure use of the Popen function with `shell=True` and unsanitized input allows attackers to execute arbitrary OS commands, potentially compromising data, escalating privileges, or deploying malware. Immediate remediation involves avoiding `shell=True` in Popen and passing commands as lists to prevent malicious command execution, thereby mitigating the risk of data breaches and system disruption.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-hj3w-wrh4-44vp
• https://github.com/hiyouga/LLaMA-Factory/commit/b3aa80d54a67da45e9e237e349486fb9c162b2ac
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52803