{"action":"Upgrade llamafactory to 0.9.4 or later.","affected":[{"fixed":"0.9.4","introduced":"0"}],"component":"llamafactory","cve_ids":["CVE-2025-61784"],"ecosystem":"PyPI","epss":0.00375,"exploited":false,"fixed_versions":["0.9.4"],"ghsa_id":"GHSA-527m-2xhr-j27g","id":"tcs_01M5KEZJ1M0DTNETVGA894CKM3","modified_at":"2026-07-07T17:56:13.530041768Z","published_at":"2025-10-07T22:08:53Z","references":["https://osv.dev/vulnerability/GHSA-527m-2xhr-j27g","https://github.com/hiyouga/LlamaFactory/security/advisories/GHSA-527m-2xhr-j27g","https://nvd.nist.gov/vuln/detail/CVE-2025-61784","https://github.com/hiyouga/LLaMAFactory/commit/95b7188090a1018935c9dc072bfc97f24f1c96e9","https://github.com/hiyouga/LLaMA-Factory"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-527m-2xhr-j27g","url":"https://osv.dev/vulnerability/GHSA-527m-2xhr-j27g"}],"summary":"LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities"}