Hiyouga Llama-factory — known CVE vulnerabilities

Every CVE whose affected-product data names Hiyouga Llama-factory, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2026-58116 — CVSS 9.8 (critical): LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary…
• CVE-2025-53002 — CVSS 8.3 (high): LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions…
• CVE-2025-61784 — CVSS 7.6 (high): LLaMA-Factory is a tuning library for large language models. Prior to version 0.9.4, a Server-Side Request Forgery (SSRF) vulnerability in…
• CVE-2024-52803 — CVSS 7.5 (high): LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the…
• CVE-2025-46567 — CVSS 6.1 (medium): LLama Factory enables fine-tuning of large language models. Prior to version 1.0.0, a critical vulnerability exists in the…