Description

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant filenames from the Hub API siblings rfilename field, directly into Python source code without escaping, allowing the crafted filename to break out of the generated string literal and execute injected code on the user's machine before any model download occurs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-26T18:16:42.760Z",
  "pubdate": "2026-08-26T18:16:42.760Z",
  "executiveSummary": "The vulnerability is a code injection flaw identified in whichllm versions prior to 0.5.16. The issue arises from the insecure handling of metadata retrieved from HuggingFace repositories, specifically within the 'run' and 'snippet' commands.\nBy manipulating a GGUF filename on a remote HuggingFace repository to include arbitrary characters, an attacker can escape the intended string context during the generation of Python source code.\nThis allows for arbitrary code execution on the host machine of any user attempting to interact with the malicious repository via the affected whichllm CLI tools.\nThe vulnerability carries a critical risk as it enables remote attackers to execute commands with the privileges of the user running the CLI tool, potentially leading to full system compromise or sensitive data exfiltration.\nExploitation is straightforward and does not require authentication; the attacker only needs to host a repository on the HuggingFace Hub and lure the victim into executing a command targeting said repository.",
  "technicalDetails": "The vulnerability resides in the script generation logic located within 'cli.py'. The application architecture retrieves model metadata from the HuggingFace Hub API, specifically targeting the 'rfilename' field associated with GGUF variants.\nThe root cause is the direct interpolation of these externally controlled strings into Python source code templates without prior sanitization, character escaping, or validation. The application constructs dynamic Python scripts where model metadata is inserted directly into string literals.\nAn attacker can craft a malicious GGUF filename containing special characters, such as a double quote character followed by arbitrary Python commands (e.g., '\"; import os; os.system(\"command\"); #'). When 'whichllm' generates the execution script, the injected quote terminates the intended string literal, allowing subsequent characters to be interpreted as valid Python syntax rather than data.\nThe attack flow follows a predictable sequence: first, the attacker hosts a malicious model on HuggingFace containing a crafted 'rfilename'. Second, the victim runs a 'whichllm run' or 'whichllm snippet' command pointing to the compromised repository. Third, the 'whichllm' CLI fetches the repository metadata via the Hub API.\nUpon receiving the payload, 'cli.py' processes the metadata and generates the Python snippet, inadvertently including the attacker's code. This code is then executed in the victim's environment. Crucially, the execution occurs before the model download process begins, meaning the payload is triggered even if the user cancels the download after realizing the model is illegitimate.\nBecause the execution happens directly within the user's local Python environment, the attacker gains the ability to execute any command, access local files, or move laterally within the victim's network, depending on the current user's system permissions. This exploit is effective against all whichllm installations prior to version 0.5.16."
}