{"action":"Upgrade llamafactory to 0.9.3 or later.","affected":[{"fixed":"0.9.3","introduced":"0"}],"component":"llamafactory","cve_ids":["CVE-2025-46567"],"ecosystem":"PyPI","epss":0.00285,"exploited":false,"fixed_versions":["0.9.3"],"ghsa_id":"GHSA-f2f7-gj54-6vpv","id":"tcs_01M5KFE3R2S7W3JR4RRGAXENVC","modified_at":"2026-09-10T03:50:23.927404812Z","published_at":"2025-04-23T22:21:13Z","references":["https://osv.dev/vulnerability/GHSA-f2f7-gj54-6vpv","https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-f2f7-gj54-6vpv","https://nvd.nist.gov/vuln/detail/CVE-2025-46567","https://github.com/hiyouga/LLaMA-Factory/commit/2989d39239d2f46e584c1e1180ba46b9768afb2a","https://github.com/hiyouga/LLaMA-Factory","https://github.com/hiyouga/LLaMA-Factory/blob/main/scripts/convert_ckpt/llamafy_baichuan2.py#L35"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-f2f7-gj54-6vpv","url":"https://osv.dev/vulnerability/GHSA-f2f7-gj54-6vpv"}],"summary":"LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py"}