CVE-2026-58116 affects hiyouga's LLaMA-Factory through version 0.9.5. The vulnerability allows remote code execution by an attacker who has access to the WebUI. The application accepts a user-supplied model path and passes it unvalidated to Hugging Face transformers library functions AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with the parameter trust_remote_code=True. This setting causes the library to fetch and execute arbitrary code from the specified model repository, which can be remote or local, under the privileges of the server process. This leads to a critical security risk of arbitrary code execution on the server.

An attacker with WebUI access can execute arbitrary Python code on the server hosting LLaMA-Factory, potentially leading to full system compromise. The vulnerability is critical due to the lack of required privileges or user interaction and the high impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable WebUI access to trusted users only. Avoid supplying untrusted model paths to the application. Monitor vendor channels for official patches or updates addressing this vulnerability.