CVE-2024-52803

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-52803
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52803.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-52803
Aliases
Published
2024-11-21T16:53:18.398Z
Modified
2026-01-01T05:49:08.189762Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
LLama Factory Remote OS Command Injection Vulnerability
Details

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on the host system. The issue is caused by insecure usage of the Popen function with shell=True, coupled with unsanitized user input. Immediate remediation is required to mitigate the risk. This vulnerability is fixed in 0.9.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52803.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/hiyouga/llama-factory

Affected ranges

Type
GIT
Repo
https://github.com/hiyouga/llama-factory
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
57354fc9904fe36daa6ddd9010d4936d84188ddb

Affected versions

v0.*
v0.0.9
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.5.2
v0.5.3
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52803.json"

Git / github.com/hiyouga/llamafactory

Affected ranges

Type
GIT
Repo
https://github.com/hiyouga/llamafactory
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b3aa80d54a67da45e9e237e349486fb9c162b2ac

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52803.json"