{"metadata": {"vulnerability": "cve-2025-53002", "count": 17, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2025-06-24T03:50:36.795Z", "date_only": false, "value": "2025-06-24T03:50:36.795Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-53002", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-06-26T06:03:23Z", "date_only": false, "value": "2025-06-26T06:03:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/hiyouga/LlamaFactory/security/advisories/GHSA-xj56-p8mm-qmxj", "record": "CVE-2025-53002", "field": "creation_timestamp", "uuid": "6f0edca4-8c37-42b2-9763-0a4915910f72", "url": "https://github.com/hiyouga/LlamaFactory/security/advisories/GHSA-xj56-p8mm-qmxj"}, {"timestamp": "2025-06-26T14:40:52.764Z", "date_only": false, "value": "2025-06-26T14:40:52.764Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-53002", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-06-26T14:40:52.764Z", "date_only": false, "value": "2025-06-26T14:40:52.764Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2025-53002", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-06-26T14:51:58Z", "date_only": false, "value": "2025-06-26T14:51:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19608", "record": "CVE-2025-53002", "field": "creation_timestamp", "uuid": "8a591fd5-f33e-44c0-a656-e32b3b672252", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-53002\n\ud83d\udd25 CVSS Score: 8.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)\n\ud83d\udd39 Description: LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`. Version 0.9.4 contains a fix for the issue.\n\ud83d\udccf Published: 2025-06-26T14:40:52.764Z\n\ud83d\udccf Modified: 2025-06-26T14:40:52.764Z\n\ud83d\udd17 References:\n1. https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-xj56-p8mm-qmxj\n2. https://github.com/hiyouga/LLaMA-Factory/commit/bb7bf51554d4ba8432333c35a5e3b52705955ede\n3. https://drive.google.com/file/d/1AddKm2mllsXfuvL4Tvbn_WJdjEOYXx4y/view?usp=sharing", "url": "https://t.me/DarkWebInformer_CVEAlerts/19608"}, {"timestamp": "2025-06-26T15:05:57.527Z", "date_only": false, "value": "2025-06-26T15:05:57.527009Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-53002", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-06-26T15:05:57.527Z", "date_only": false, "value": "2025-06-26T15:05:57.527009Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-53002", "record": "FKIE_CVE-2025-53002", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-06-26T15:12:51.382Z", "date_only": false, "value": "2025-06-26T15:12:51.382Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-53002", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-06-26T15:12:51.382Z", "date_only": false, "value": "2025-06-26T15:12:51.382Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-53002", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-06-26T15:15:23Z", "date_only": false, "value": "2025-06-26T15:15:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XJ56-P8MM-QMXJ", "record": "GHSA-XJ56-P8MM-QMXJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-06-26T15:15:23.873Z", "date_only": false, "value": "2025-06-26T15:15:23.873", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-53002", "record": "FKIE_CVE-2025-53002", "field": "published"}, {"timestamp": "2025-06-26T19:19:39.555Z", "date_only": false, "value": "2025-06-26T19:19:39.555828Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lsjtspgpr22r", "record": "CVE-2025-53002", "field": "creation_timestamp", "uuid": "73a89d0d-e119-4844-b89b-241612b62f1b", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lsjtspgpr22r"}, {"timestamp": "2025-06-27T15:27:01Z", "date_only": false, "value": "2025-06-27T15:27:01Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XJ56-P8MM-QMXJ", "record": "GHSA-XJ56-P8MM-QMXJ", "field": "published"}, {"timestamp": "2025-06-27T15:27:02Z", "date_only": false, "value": "2025-06-27T15:27:02Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XJ56-P8MM-QMXJ", "record": "GHSA-XJ56-P8MM-QMXJ", "field": "modified"}, {"timestamp": "2026-06-17T09:37:27.313Z", "date_only": false, "value": "2026-06-17T09:37:27.313", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-53002", "record": "FKIE_CVE-2025-53002", "field": "lastModified"}, {"timestamp": "2026-07-07T16:02:55.806Z", "date_only": false, "value": "2026-07-07T16:02:55.806852Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-1576", "record": "PYSEC-2026-1576", "field": "published"}, {"timestamp": "2026-07-07T17:24:34.925Z", "date_only": false, "value": "2026-07-07T17:24:34.925680Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-1576", "record": "PYSEC-2026-1576", "field": "modified"}]}