CVE-2026-58474
Received Received - Intake

Code Injection in whichllm via Malicious GGUF Filename

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant filenames from the Hub API siblings rfilename field, directly into Python source code without escaping, allowing the crafted filename to break out of the generated string literal and execute injected code on the user's machine before any model download occurs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-09-16
AI Q&A
2026-08-26
EPSS Evaluated
2026-09-14
NVD
CVE-2026-58474
EUVD
EUVD-2026-66642

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
whichllm whichllm to 0.5.16 (exc)
andyyyy64 whichllm to 0.5.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

whichllm before 0.5.16 has a code injection vulnerability in the run and snippet commands. A remote attacker controlling a HuggingFace repository can execute arbitrary code by crafting a malicious GGUF filename with special characters like double quotes. The cli.py script directly interpolates HuggingFace-derived values into Python source code without proper escaping, allowing the filename to break out of string literals and execute injected code before any model download.

Detection Guidance

To detect this vulnerability, check the version of whichllm installed on your system. Run: whichllm --version. If the version is below 0.5.16, the system is vulnerable. Additionally, inspect generated scripts for improperly escaped metadata in cli.py or related files.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your machine if you use a vulnerable version of whichllm and interact with a malicious HuggingFace repository. The attack occurs before any model is downloaded, meaning even browsing or running commands could lead to system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or unauthorized access to sensitive information. Such incidents may violate GDPR (data protection), HIPAA (healthcare data), or other regulations, leading to legal penalties, fines, or reputational damage due to non-compliance with security requirements.

Mitigation Strategies

Update whichllm to version 0.5.16 or later to address the code injection vulnerability in the run and snippet commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart