CVE-2026-112080: Code Injection in LlamaChinese Llama-Chinese

This vulnerability in LlamaChinese Llama-Chinese involves the function get_class_from_dynamic_module within the Adapter Config component. By manipulating the base_model_name_or_path argument, an attacker can perform code injection remotely. The product's rolling release model means version details for affected or patched releases are not provided. The vendor has been notified but has not responded or released a fix. Exploit code has been made public, though no known exploitation in the wild is reported.

Successful exploitation allows remote attackers to inject arbitrary code via the base_model_name_or_path argument, potentially compromising the system running LlamaChinese Llama-Chinese. The medium CVSS score reflects moderate impact with low attack complexity and no privileges required, but user interaction is needed. The lack of vendor response and public exploit availability increases risk.

No official fix or patch has been released yet, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is available, avoid exposing the vulnerable function to untrusted inputs or remote users. Consider restricting access or applying additional input validation as a temporary measure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.