PyPI/llamafactory CVE-2025-46567: medium 6.1, EPSS 0.29%
LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py
Action: Upgrade llamafactory to 0.9.3 or later.
pip install llamafactory==0.9.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.3 | - |
Fixed versions
| 0.9.3 |
Sources
- osv: GHSA-f2f7-gj54-6vpv
- https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-f2f7-gj54-6vpv
- https://nvd.nist.gov/vuln/detail/CVE-2025-46567
- https://github.com/hiyouga/LLaMA-Factory/commit/2989d39239d2f46e584c1e1180ba46b9768afb2a
- https://github.com/hiyouga/LLaMA-Factory
- https://github.com/hiyouga/LLaMA-Factory/blob/main/scripts/convert_ckpt/llamafy_baichuan2.py#L35
CVE-2025-46567 · published · modified · JSON