jllama-py (>=1.0.0 <=1.1.14) potentially affected by CVE-2025-61784 via llamafactory (=0.9.3)

llamafactory PYPI version =0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on llamafactory and may be impacted: - jllama-py =1.0.0, =1.1.14 Source cves: CVE-2025-61784 Source advisory: SNYK:PYTHON-LLAMAFACTORY-13450903...

jllama-py (>=1.0.0 <=1.1.14) potentially affected by CVE-2025-61784 via llamafactory (=0.9.3)

llamafactory PYPI version =0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on llamafactory and may be impacted: - jllama-py =1.0.0, =1.1.14 Source cves: CVE-2025-61784 Source advisory: OSV:GHSA-527M-2XHR-J27G...

jllama-py (>=1.0.0 <=1.1.14) potentially affected by CVE-2025-53002 via llamafactory (=0.9.3)

llamafactory PYPI version =0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on llamafactory and may be impacted: - jllama-py =1.0.0, =1.1.14 Source cves: CVE-2025-53002 Source advisory: SNYK:PYTHON-LLAMAFACTORY-12671321...

jllama-py (>=1.0.0 <=1.1.14) potentially affected by CVE-2025-53002 via llamafactory (=0.9.3)

llamafactory PYPI version =0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on llamafactory and may be impacted: - jllama-py =1.0.0, =1.1.14 Source cves: CVE-2025-53002 Source advisory: OSV:GHSA-XJ56-P8MM-QMXJ...

CVE-2025-46567

creationtimestamp| type| source ---|---|--- 2025-04-23 08:41:15+00:00| published-proof-of-concept| https://github.com/hiyouga/LlamaFactory/security/advisories/GHSA-f2f7-gj54-6vpv...

Command Injection

Overview llamafactory is an Easy-to-use LLM fine-tuning framework Affected versions of this package are vulnerable to Command Injection insecure usage of the Popen function with shell=True, coupled with unsanitized user input. An attacker can execute arbitrary commands on the operating system,...

Clone LlamaCore and LlamaPolicy in LlamaFactory.sol may fail or DOS

Lines of code Vulnerability details Impact LlamaFactory uses Clones.cloneDeterministic to create new LlamaCore and LlamaPolicy contracts. The address of the new PrivatePool depends solely on the name parameter keccak256abi.encodePackedname provided by the administrator when calling the deploy...