{"action":"Upgrade llamafactory to 0.9.3 or later.","affected":[{"fixed":"0.9.3","introduced":"0"}],"component":"llamafactory","cve_ids":["CVE-2025-46567"],"ecosystem":"PyPI","epss":0.00285,"exploited":false,"fixed_versions":["0.9.3"],"ghsa_id":"GHSA-f2f7-gj54-6vpv","id":"tcs_01M5KGTDG09034MXMK2D8YAYAE","modified_at":"2026-07-07T17:46:54.115506616Z","published_at":"2026-07-07T16:02:51.349594Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1574","https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-f2f7-gj54-6vpv","https://nvd.nist.gov/vuln/detail/CVE-2025-46567","https://github.com/hiyouga/LLaMA-Factory/commit/2989d39239d2f46e584c1e1180ba46b9768afb2a","https://github.com/hiyouga/LLaMA-Factory","https://github.com/hiyouga/LLaMA-Factory/blob/main/scripts/convert_ckpt/llamafy_baichuan2.py#L35","https://pypi.org/project/llamafactory","https://github.com/advisories/GHSA-f2f7-gj54-6vpv"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-1574","url":"https://osv.dev/vulnerability/PYSEC-2026-1574"}],"summary":"LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py"}