CVE-2026-58474: Improper Control of Generation of Code ('Code Injection') in Andyyyy64 whichllm

CVE-2026-58474 is a code injection vulnerability in whichllm prior to version 0.5.16. The vulnerability exists in the run and snippet commands where the script generation function (cli.py) interpolates values derived from the HuggingFace Hub API, specifically GGUF variant filenames from the siblings rfilename field, directly into Python source code without proper escaping. An attacker controlling a HuggingFace repository can craft a malicious GGUF filename containing double quotes or other special characters to break out of the string literal context and inject arbitrary code. This code executes on the user's machine before any model download is initiated, allowing remote code execution.

A remote attacker who controls a HuggingFace repository can exploit this vulnerability to achieve arbitrary code execution on the victim's machine without requiring privileges or user interaction beyond invoking the vulnerable commands. This can lead to full compromise of the affected system. The CVSS 4.0 score is 8.6 (high severity), reflecting the network attack vector, low complexity, no privileges required, but requiring user interaction and resulting in high confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the vulnerable run and snippet commands with untrusted HuggingFace repositories or GGUF filenames. Validate and sanitize inputs derived from external sources before use in code generation contexts.