Affected: hiyouga LLaMA-Factory

LLama Factory enables fine-tuning of large language models. Prior to version 1.0.0, a critical vulnerability exists in the `llamafy_baichuan2.py` script of the LLaMA-Factory project. The script performs insecure deserialization using `torch.load()` on user-supplied `.bin` files from an input directory. An attacker can exploit this behavior by crafting a malicious `.bin` file that executes arbitrary commands during deserialization. This issue has been patched in version 1.0.0.

Affected: PyPI: llamafactory

### Description

A critical vulnerability exists in the `llamafy_baichuan2.py` script of the [LLaMA-Factory](https://github.com/hiyouga/LLaMA-Factory) project. The script performs insecure deserialization using `torch.load()` on user-supplied `.bin` files from an input directory. An attacker can exploit this behavior by crafting a malicious `.bin` file that executes arbitrary commands during deserialization.

### Attack Vector

This vulnerability is **exploitable without authentication or privileges** when a user is tricked into:

1. Downloading or cloning a malicious project folder containing a crafted `.bin` file (e.g. via zip file, GitHub repo). 2. Running the provided conversion script `llamafy_baichuan2.py`, either manually or as part of an example workflow.

No elevated privileges are required. The user only needs to run the script with an attacker-supplied `--input_dir`.

### Impact

- Arbitrary command execution (RCE) - System compromise - Persistence or lateral movement in shared compute environments

### Proof of Concept (PoC)

```python # malicious_payload.py import torch, pickle, os

class MaliciousPayload: def __reduce__(self): return (os.system, ("mkdir HACKED!",)) # Arbitrary command

malicious_data = { "v_head.summary.weight": MaliciousPayload(), "v_head.summary.bias": torch.randn(10) }

with open("value_head.bin", "wb") as f: pickle.dump(malicious_data, f) ```

An example of `config.json`:

```json { "model": "value_head.bin",…