1 published AI models are associated with this package: 0 name it in a requirements or pyproject file, 1 load it or import it directly, and 0 are inferred from the runtime stack their declared library pulls in. Only 0 state a version requirement, so this is not a count of affected models.
cvss
9.8
critical
CVSS v3.1 base score out of 10
epss
0.33%
low
chance of exploitation in 30 days, 26th percentile of all CVEs
xyz score
4.7
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-g76p-4vg5-f4qh, the advisory selected below
The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Checked 2026-11-06 at 22:34 UTC. The most recent advisory here was published 2026-05-12. Updated continuously from NVD, GHSA, OSV and CNA feeds.