PyPI/llamafactory CVE-2025-61784: high 7.6, EPSS 0.38%
LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities
Action: Upgrade llamafactory to 0.9.4 or later.
pip install llamafactory==0.9.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9.4 | - |
Fixed versions
| 0.9.4 |
Sources
- osv: PYSEC-2026-1573
- https://github.com/hiyouga/LlamaFactory/security/advisories/GHSA-527m-2xhr-j27g
- https://nvd.nist.gov/vuln/detail/CVE-2025-61784
- https://github.com/hiyouga/LLaMAFactory/commit/95b7188090a1018935c9dc072bfc97f24f1c96e9
- https://github.com/hiyouga/LLaMA-Factory
- https://pypi.org/project/llamafactory
- https://github.com/advisories/GHSA-527m-2xhr-j27g
CVE-2025-61784 · published · modified · JSON