CVE-2025-53002 is a high severity (CVSS 8.3) remote code execution flaw in LLaMA-Factory, the large language model tuning library. Versions up to and including 0.9.3 load a value head file without safe settings. The patched version is 0.9.4, so upgrade and avoid loading checkpoints from sources you do not trust.
What's affected
The GitHub advisory GHSA-xj56-p8mm-qmxj lists the pip package llamafactory, affected versions 0.9.3 and earlier, and patched version 0.9.4. The record classifies the weakness as deserialization of untrusted data (CWE-502) and code injection (CWE-94).
The advisory explains the cause. In the web interface, the Checkpoint path setting changes the adapter_name_or_path value passed to the training process. That value is then used to fetch a value_head.bin file, which is loaded with torch.load without the weights_only=True argument. A file crafted by an attacker can then run code when it is loaded. The advisory says this happens in the reward modeling training stage.
It also notes that in PyTorch versions before 2.6 the default for weights_only is False, and that LLaMA-Factory's setup only required torch 2.0.0 or newer, so many installs were exposed by default.
How to check if you're exposed
Check the installed versions in each environment where you run the library, such as a GPU training box, a notebook server or a container image:
pip show llamafactory
pip show torch
If llamafactory is 0.9.3 or lower, it is in the affected range. The torch version tells you whether the safer default for loading is in place, but the advisory still recommends the fix in the library, so do not rely on the torch version alone.
Then look at how the web interface is run. If it listens on a network address and not on localhost, anyone who can reach it can set a checkpoint path. Check your launch commands, container port mappings and any shared notebook proxy.
What to do now
- Upgrade llamafactory to 0.9.4 or later in every environment, and rebuild container images that pin the old version.
- Upgrade PyTorch to 2.6 or later where your stack allows it, since that release changed the default for safe loading.
- Do not expose the web interface to untrusted networks. Bind it to localhost or place it behind authentication and a VPN.
- Only load checkpoints and value head files from repositories and paths you trust and have reviewed.
- Run training jobs under an account with limited rights and no access to production secrets or cloud credentials.
Why it matters
Python's pickle based loading formats can run code as a side effect of reading a file. That is by design, which is why loading a model file from an unknown source is like running a program from that source. The weights_only option restricts what torch.load will accept, and the flaw here is that one load call did not use it.
The advisory describes the attack as stealthy because the user sees an ordinary training run. Training machines often have fast storage, GPUs and cloud keys, which makes them worth reaching. The record gives no sign of use in attacks, and the CVE is not on the CISA Known Exploited Vulnerabilities list. In practice the safest habit is to treat model artifacts as code and to scan the dependencies of your ML projects like any other software.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does upgrading PyTorch alone fix it?
The advisory points to the library fix in 0.9.4. A newer torch changes the default for safe loading, but upgrade LLaMA-Factory as well.
Who needs to worry most?
Anyone who runs the web interface on a reachable network address, or who loads checkpoints from paths they do not control.
Sources
Last reviewed: 18 October 2026.
