Command Injection

Overview llamafactory is an Easy-to-use LLM fine-tuning framework Affected versions of this package are vulnerable to Command Injection insecure usage of the Popen function with shell=True, coupled with unsanitized user input. An attacker can execute arbitrary commands on the operating system,...