{"id":"CVE-2026-112080","kind":"vulnerability","aliases":["CVE-2026-112080"],"related":[],"title":"Llama-Chinese: adapter config argument allows remote code injection","description":"A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Llama-Chinese example chat script passes the base_model_name_or_path argument into get_class_from_dynamic_module in the Adapter Config component, so a crafted value can inject code. A remote attacker can trigger it, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gradio","llama-chinese","llm","python"],"not_affected_if":["example-not-deployed","no-remote-input"],"how_to_check":"- Check whether you run examples/chat_gradio_no_merge.py from the Llama-Chinese repository, for example with `grep -n get_class_from_dynamic_module examples/chat_gradio_no_merge.py`\n- Check whether the Gradio chat example is exposed to other users or networks\n- Check the repository commit with `git rev-parse HEAD` against 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b","fix":"- No fixed version is known: the project uses rolling releases and has not responded to the report\n- Do not run the chat_gradio_no_merge.py example with untrusted base_model_name_or_path input\n- Restrict network access to any running Gradio example until a fix is confirmed","status":"open","published_at":"2026-10-19T05:17:04+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:21+00:00","updated_at":"2026-10-25T03:23:21+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:23:21Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is known: the project uses rolling releases and has not responded to the report\n- Do not run the chat_gradio_no_merge.py example with untrusted base_model_name_or_path input\n- Restrict network access to any running Gradio example until a fix is confirmed","reach":"internet","title":"Llama-Chinese: adapter config argument allows remote code injection","impact":"high","summary":"The Llama-Chinese example chat script passes the base_model_name_or_path argument into get_class_from_dynamic_module in the Adapter Config component, so a crafted value can inject code. A remote attacker can trigger it, and a public exploit exists.","category":"ai-tooling","nicknames":[],"who_cares":["llama-chinese","python","gradio","llm"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the server hosting the example","analyst_note":"Confirm whether the Gradio example endpoint accepts base_model_name_or_path from remote users and whether any fix exists, using the NVD entry and the upstream repository issue.","how_to_check":"- Check whether you run examples/chat_gradio_no_merge.py from the Llama-Chinese repository, for example with `grep -n get_class_from_dynamic_module examples/chat_gradio_no_merge.py`\n- Check whether the Gradio chat example is exposed to other users or networks\n- Check the repository commit with `git rev-parse HEAD` against 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b","needs_analyst":true,"not_affected_if":["example-not-deployed","no-remote-input"],"who_is_affected":"Teams that run the Llama-Chinese chat_gradio_no_merge.py example or code derived from it with an adapter config that takes a model path from outside input. Exposure depends on whether the base_model_name_or_path value can be set by a remote user. Teams that only use the library's training or inference code without this example can likely skip it, but the sources do not confirm which other files are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":3459,"output_tokens":739,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112080':13A,16A '-2026':12A,15A '6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b':81C 'adapt':4A,49B,100C 'affect':149C 'ai':18B 'ai-tool':17B 'allow':7A 'argument':6A,40B,106C 'attack':61B,117C 'base':35B,107C 'chat':31B 'chines':3A,23B,29B,78C 'class':43B,89C 'code':9A,58B,114C 'compon':51B,99C 'config':5A,50B,101C 'continu':141C 'could':130C 'craft':54B 'cve':11A,14A 'deliveri':142C 'disclos':155C 'dynam':45B,91C 'earli':163C 'element':84C 'exampl':30B 'examples/chat_gradio_no_merge.py':96C 'exist':69B 'exploit':68B,124C 'file':95C 'found':73C 'function':87C 'get':42B,88C 'gradio':20B 'impact':83C 'inform':147C,159C 'inject':10A,57B,115C 'issu':166C 'llama':2A,22B,28B,77C 'llama-chines':1A,21B,27B,76C 'llamachines':75C 'llm':24B 'made':127C 'manipul':103C 'may':118C 'model':36B,108C 'modul':46B,92C 'name':37B,109C 'pass':33B 'path':39B,111C 'perform':120C 'problem':162C 'product':134C 'project':157C 'public':67B,128C 'python':25B 'releas':138C,152C 'remot':8A,60B,122C 'report':167C 'respond':171C 'result':112C 'roll':137C 'script':32B 'system':139C 'tool':19B 'trigger':63B 'updat':151C 'use':132C 'util':135C 'valu':55B 'version':146C 'vulner':71C 'yet':172C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Llama-Chinese chat_gradio_no_merge.py example or code derived from it with an adapter config that takes a model path from outside input. Exposure depends on whether the base_model_name_or_path value can be set by a remote user. Teams that only use the library's training or inference code without this example can likely skip it, but the sources do not confirm which other files are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T05:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112080","severity":null,"published_at":"2026-10-19T05:17:04+00:00","modified_at":"2026-10-19T18:17:02+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}