AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2025-53002

HIGH · CVSS 8.3 EPSS 1.05% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2025-06-26 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.3. Public exploit code or proof-of-concept references have been detected in its references. It may be remotely exploitable.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2025-53002
Severity
HIGH
CVSS
8.3
EPSS
1.05%

Original NVD Description

LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`. Version 0.9.4 contains a fix for the issue.

Related CVEs

Other vulnerabilities affecting the same vendor(s)