{"cve":"CVE-2024-34359","nvd":{"published":"2024-05-14T15:38:45.093","modified":"2026-06-17T07:33:14.750","status":"Deferred","description":"llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-76"],"references":["https://github.com/abetlen/llama-cpp-python/commit/b454f40a9a1787b2b5659cd2cb00819d983185df","https://github.com/abetlen/llama-cpp-python/security/advisories/GHSA-56xg-wfcc-g829","https://github.com/abetlen/llama-cpp-python/commit/b454f40a9a1787b2b5659cd2cb00819d983185df","https://github.com/abetlen/llama-cpp-python/security/advisories/GHSA-56xg-wfcc-g829"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:49:23.840078609+00:00"},"epss":{"cve":"CVE-2024-34359","score":0.26001,"percentile":0.97985,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-56xg-wfcc-g829","url":"https://osv.dev/vulnerability/GHSA-56xg-wfcc-g829","summary":"llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata","modified":"2026-09-10T03:50:13.332649580Z","packages":[{"ecosystem":"PyPI","name":"llama-cpp-python","purl":"pkg:pypi/llama-cpp-python","ranges":[">=0.2.30 <0.2.72"],"fixed":["0.2.72"]}]},{"id":"PYSEC-2026-392","url":"https://osv.dev/vulnerability/PYSEC-2026-392","summary":"llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata","modified":"2026-07-13T16:15:28.194881872Z","packages":[{"ecosystem":"PyPI","name":"llama-cpp-python","purl":"pkg:pypi/llama-cpp-python","ranges":[">=0.2.30 <0.2.72"],"fixed":["0.2.72"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}