Overview
In the rapidly evolving field of artificial intelligence, vulnerabilities in the software that trains and tunes large language models can have far-reaching consequences. This is the case with CVE-2025-53002, a severe remote code execution vulnerability discovered in LLaMA-Factory, a tuning library for large language models. This vulnerability affects all versions up to and including 0.9.3 and has the potential for system compromise or data leakage. The urgency and severity of the situation are underscored by a CVSS Severity Score of 8.3.
Vulnerability Summary
CVE ID: CVE-2025-53002
Severity: High (CVSS: 8.3)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Could lead to system compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
LLaMA-Factory | Up to and including 0.9.3
How the Exploit Works
The vulnerability resides in the way LLaMA-Factory loads the `vhead_file` during the training process. Specifically, the `vhead_file` is loaded without the secure parameter `weights_only=True`, which can be exploited by attackers to execute arbitrary malicious code on the host system. The attack is carried out by passing a malicious `Checkpoint path` parameter through the WebUI interface. The stealthy nature of this attack leaves the victim unaware of the exploitation.
Conceptual Example Code
In a conceptual sense, an attacker could exploit this vulnerability by sending a specially crafted HTTP POST request to the LLaMA-Factory WebUI interface. A pseudo-code example might look something like this:
POST /webui/checkpoint_path HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"vhead_file": "/path/to/malicious_file",
"weights_only": "False"
}In this example, the attacker is loading a malicious file through the `vhead_file` parameter and setting `weights_only` to `False`, thereby bypassing the safeguards in place and triggering the vulnerability.
Mitigation Guidance
The vulnerability has been fixed in version 0.9.4 of LLaMA-Factory. Users are strongly encouraged to update to this version as soon as possible. If immediate patching is not feasible, employing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) may serve as a temporary mitigation measure. However, these should not be viewed as long-term solutions; patching the software is the most effective way to secure your system against this vulnerability.