CVE-2026-58474

Code injection via crafted GGUF filename in whichllm 0.5.16 CLI commands.

• CVSS 8.6
• 94
• Input Validation and Sanitization
• Remote

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant filenames from the Hub API siblings rfilename field, directly into Python source code without escaping, allowing the crafted filename to break out of the generated string literal and execute injected code on the user's machine before any model download occurs.

CVE

CVE-2026-58474

CWE

94

CVSS base score

8.6

Published

2026-08-26

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

whichllm

Fixed by upgrading

Yes

Solution

Upgrade to whichllm ≥ 0.5.16.

import sys
import json
from huggingface_hub import HfApi

def generate_script(repo_id: str, variant: str) -> str:
    api = HfApi()
    # Retrieve sibling filenames for the given variant
    siblings = api.list_repo_files(repo_id, repo_type="model")
    # Find the GGUF file matching the variant
    gguf_file = next((s for s in siblings if s.endswith(f"-{variant}.gguf")), None)
    if not gguf_file:
        raise FileNotFoundError("Variant not found")
    # VULNERABLE: directly interpolating untrusted filename into generated code
    script = f'''
import torch
model = torch.load("{gguf_file}", map_location="cpu")
print("Model loaded")
'''
    return script

import sys
import json
import ast
from huggingface_hub import HfApi

def generate_script(repo_id: str, variant: str) -> str:
    api = HfApi()
    siblings = api.list_repo_files(repo_id, repo_type="model")
    gguf_file = next((s for s in siblings if s.endswith(f"-{variant}.gguf")), None)
    if not gguf_file:
        raise FileNotFoundError("Variant not found")
    # FIX: safely embed the filename using ast.literal_eval to ensure proper escaping
    safe_name = ast.literal_eval(repr(gguf_file))
    script = f'''
import torch
model = torch.load({safe_name}, map_location="cpu")
print("Model loaded")
'''
    return script

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202658474,
  title        = {{Code injection via crafted GGUF filename in whichllm 0.5.16 CLI commands.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-58474},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-58474/}}
}