CVE-2026-58474

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

EUVD-2026-66642

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-58474

whichllm before version 0.5.16 contains a code injection vulnerability in the run and snippet commands. The script generation function in cli.py interpolates HuggingFace-derived values—including GGUF variant filenames from the Hub API siblings rfilename field—directly into Python source code with...