CyberRota Analysis
AI-GeneratedA code injection vulnerability exists in whichllm versions prior to 0.5.16, allowing remote attackers to execute arbitrary code on users' machines by manipulating GGUF filenames with special characters. This flaw arises from the improper handling of user-controlled input in the script generation function, which directly interpolates values into Python source code without adequate escaping. Organizations utilizing whichllm for model execution, particularly those integrating with HuggingFace repositories, should prioritize patching this vulnerability to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant filenames from the Hub API siblings rfilename field, directly into Python source code without escaping, allowing the crafted filename to break out of the generated string literal and execute injected code on the user's machine before any model download occurs.