Vulnerability · Published Aug 26, 2026 · Assigned by VulnCheck

CVE-2026-58474whichllm < 0.5.16 Code Injection via run and snippet commands

High 8.8

In plain English

A high-severity code injection in whichllm from Andyyyy64. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant filenames from the Hub API siblings rfilename field, directly into Python source code without escaping, allowing the crafted filename to break out of the generated string literal and execute injected code on the user's machine before any model download occurs.

Affected products (as reported)

Vendor	Product	Versions
Andyyyy64	whichllm	0 – before 0.5.16

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

whichllm v0.5.16 Release Notes release-notes
Pull Request issue-tracking, patch
Patch Commit patch
https://www.vulncheck.com/advisories/whichllm-code-injection-via-run-and-snippet-commands third-party-advisory