Vulnerability · Published May 12, 2026 · Assigned by mitre
CVE-2026-31236
Critical 9.8
In plain English
A critical-severity code injection in the llm package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | llm | no fix listed | DEBIAN-CVE-2026-31236 |
| Debian:14 | llm | no fix listed | DEBIAN-CVE-2026-31236 |
| PyPI | llm | no fix listed | GHSA-g76p-4vg5-f4qh |
| PyPI | llm | no fix listed | PYSEC-2026-400 |
| Ubuntu:25.10 | llm | no fix listed | UBUNTU-CVE-2026-31236 |
| Ubuntu:26.04:LTS | llm | no fix listed | UBUNTU-CVE-2026-31236 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/simonw/llm
- https://www.notion.so/CVE-2026-31236-35d1e139318881a4a0f1fffcf671f7e3
- https://access.redhat.com/security/cve/CVE-2026-31236 vdb-entry, x_refsource_REDHAT
- RHBZ#2476636 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31236.json x_sadp-csaf-vex