tag
Huggingface
Critical
LLaMA-Factory WebUI Remote Code Execution via Hardcoded `trust_remote_code` (CVE-2026-58116)
CVE-2026-58116·
LLaMA-Factory ([hiyouga/LLaMA-Factory](https://github.com/hiyouga/LLaMA-Factory)) — WebUI Chat and Training interfaces
unpatched
Medium
Claude Code WebFetch Hardcoded HuggingFace Bare-Hostname Allow-List Bypass — CVE-2026-54316
CVE-2026-54316 (GHSA-fg94-h982-f3mm)·
@anthropic-ai/claude-code (npm package, Claude Code CLI)
patched
High
AI Model-Loader `trust_remote_code` Order-of-Operations RCE Simulation (CVE-2026-22807)
CVE-2026-22807·
AI inference/model-loading frameworks that resolve custom model classes via auto_map before validating trust_remote_code (pattern seen in vLLM/Transformers-style loaders)
unpatched