TI-2026-42078 CVE-2026-58474 · GHSA-hfpc-7mr4-p297
whichllm < 0.5.16 Code Injection via run and snippet commands
Priority MEDIUM 41
whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicio…