CVE-2026-31236

The llm CLI tool (versions through 0.27.1 ) is vulnerable to a critical code injection flaw via the --functions command-line argument. The tool fails to sanitize, sandbox, or restrict the custom Python function definitions provided by users, instead executing them directly using the unsafe exec()...

CVE-2026-31236

The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec function...