PyPI/llamafactory CVE-2024-52803: high 7.5, EPSS 2.32%
LLama Factory Remote OS Command Injection Vulnerability
Action: Upgrade llamafactory to 0.9.1 or later.
pip install llamafactory==0.9.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.1 | - |
Fixed versions
| 0.9.1 |
Sources
- osv: GHSA-hj3w-wrh4-44vp
- https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-hj3w-wrh4-44vp
- https://nvd.nist.gov/vuln/detail/CVE-2024-52803
- https://github.com/hiyouga/LLaMA-Factory/commit/b3aa80d54a67da45e9e237e349486fb9c162b2ac
- https://gist.github.com/superboy-zjc/f2d2b93ae511c445ba97e144b70e534d
- https://github.com/hiyouga/LLaMA-Factory
CVE-2024-52803 · published · modified · JSON