---
id: "CVE-2026-112080"
kind: "vulnerability"
aliases: ["CVE-2026-112080"]
title: "Llama-Chinese: adapter config argument allows remote code injection"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "gradio", "llama-chinese", "llm", "python"]
not_affected_if: ["example-not-deployed", "no-remote-input"]
published_at: "2026-10-19T05:17:04+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:23:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112080", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Llama-Chinese: adapter config argument allows remote code injection

The Llama-Chinese example chat script passes the base_model_name_or_path argument into get_class_from_dynamic_module in the Adapter Config component, so a crafted value can inject code. A remote attacker can trigger it, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether you run examples/chat_gradio_no_merge.py from the Llama-Chinese repository, for example with `grep -n get_class_from_dynamic_module examples/chat_gradio_no_merge.py`
- Check whether the Gradio chat example is exposed to other users or networks
- Check the repository commit with `git rev-parse HEAD` against 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b

## Fix

- No fixed version is known: the project uses rolling releases and has not responded to the report
- Do not run the chat_gradio_no_merge.py example with untrusted base_model_name_or_path input
- Restrict network access to any running Gradio example until a fix is confirmed

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112080

## From the sources

A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_