Code Injection Vulnerability in LlamaChinese Llama-Chinese Adapter Config
CVE-2026-112080

5.3MEDIUM

Key Information:

Vendor

Llamachinese

Status
Llama-chinese
Vendor
CVE Published:
19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-112080?

A code injection vulnerability has been identified in the LlamaChinese Llama-Chinese Adapter Config through the get_class_from_dynamic_module function located in examples/chat_gradio_no_merge.py. The flaw allows an attacker to manipulate the base_model_name_or_path argument, potentially leading to unauthorized execution of malicious code. As the product follows a rolling release system, specific version details for affected or patched releases are not provided. Despite being alerted to this issue by a concerned report, the project maintainers have yet to respond.

Affected Version(s)

Llama-Chinese 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-112080 - Proof of Concept

References

https://vuldb.com/vuln/421759
vdb-entrytechnical-description
https://vuldb.com/vuln/421759/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112080
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

r1ck9 (VulDB User)
VulDB CNA Team
.