CVE-2025-53002 is a high-severity (CVSS 8.3) Code Injection vulnerability in llamafactory. No vendor fix is recorded yet; mitigation options are listed below.
LLaMA-Factory Remote Code Execution (RCE) Vulnerability
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-53002.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2025-53002 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
llamafactoryReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A critical remote code execution vulnerability was discovered during the Llama Factory training process. This vulnerability arises because the vhead_file is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious Checkpoint path parameter through the WebUI interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the vhead_file argument is loaded without the secure parameter weights_only=True.
Note: In torch versions <2.6, the default setting is weights_only=False, and Llama Factory's setup.py only requires torch>=2.0.0.
Affected Version
Llama Factory versions <=0.9.3 are affected by this vulnerability.
Details
-
In LLaMA Factory's WebUI, when a user sets the
<img width="1040" alt="image-1" src="https://github.com/user-attachments/assets/c8bc79e4-ce7d-43c9-b0fd-e37c235e6585" />Checkpoint path, it modifies theadapter_name_or_pathparameter passed to the training process. code in src/llamafactory/webui/runner.py -
The
<img width="1181" alt="image-2" src="https://github.com/user-attachments/assets/6edbe694-0c60-4a54-bfb3-5e1042c9230d" />adapter_name_or_pathpassed to the training process is then used insrc/llamafactory/model/model_utils/valuehead.pyto fetch the correspondingvalue_head.binfile from Hugging Face. This file is subsequently loaded viatorch.load()without the security parameterweights_only=Truebeing set, resulting in remote code execution. code in src/llamafactory/model/model_utils/valuehead.py
PoC
Steps to Reproduce
- Deploy llama factory.
- Remote attack through the WebUI interface
- Configure
Model nameandModel pathcorrectly. For demonstration purposes, we'll use a small modelllamafactory/tiny-random-Llama-3to accelerate model loading. - Set
Finetuning methodtoLoRAandTrain StagetoReward Modeling. The vulnerability is specifically triggered during the Reward Modeling training stage. - Input a malicious Hugging Face path in
Checkpoint path– here we usepaulinsider/llamafactory-hack. This repository(https://huggingface.co/paulinsider/llamafactory-hack/tree/main ) contains a maliciousvalue_head.binfile. The generation method for this file is as follows (it can execute arbitrary attack commands; for demonstration, we configured it to create aHACKED!folder). - Click
Startto begin training. After a brief wait, aHACKED!folder will be created on the server. Note that arbitrary malicious code could be executed through this method.
- Configure
The video demonstration of the vulnerability exploitation is available at the Google Drive Link
Impact
Exploitation of this vulnerability allows remote attackers to:
- Execute arbitrary malicious code / OS commands on the server.
- Potentially compromise sensitive data or escalate privileges.
- Deploy malware or create persistent backdoors in the system. This significantly increases the risk of data breaches and operational disruption.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | llamafactory | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for llamafactory, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of llamafactory has shipped for CVE-2025-53002 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2025-53002 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2025-53002. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2025-53002 in your dependencies?
O3 Security finds CVE-2025-53002 across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.