CVE-2026-58138CVSS 9.8 Critical2026-07-01
Orkes Conductor Unauthenticated Remote Code Execution Leading to Arbitrary System Command Execution
In Orkes Conductor versions 3.21.21 through 3.30.2 (excluding 3.30.2), the workflow API endpoint lacks pre-authentication validation, resulting in unauthenticated remote code execution (CWE-94). An attacker can submit an inline workflow definition containing malicious JavaScript or Python expressions and, through the non-sandboxed GraalVM evaluator configured with HostAccess.ALL or allowAll(true), execute arbitrary operating system commands via Java reflection or direct subprocess invocation using the INLINE, LAMBDA, DO_WHILE and SWITCH task types. The vulnerability affects all Orkes Conductor users who have not updated to 3.30.2, including enterprise workflow automation deployments. An attacker can launch the attack remotely without any authentication credentials, requiring no user interaction and gaining direct control of the server.
Component
Orkes Conductor is an open-source microservice orchestration engine used to build and manage complex workflow automation tasks, supporting multiple task types and dynamic expression evaluation.
Risks
- From standard user to administrator: If the victim runs the Orkes Conductor service with elevated privileges, the attacker gains the same privileges
- Complete system control: An attacker can execute arbitrary code on the server, and depending on service privileges, install programs, view/modify/delete data or create new accounts with full privileges
- No user interaction required: By reaching the workflow API endpoint directly, an attacker only needs to send a crafted request to trigger the vulnerability, with no additional interaction
Source
Remediation- Immediately upgrade Orkes Conductor to version 3.30.2 or later
- Enable strict sandbox isolation for the GraalVM evaluator and disable HostAccess.ALL
- Restrict access to workflow API endpoints and enforce strict authentication and input validation
CVE-2026-58116CVSS 9.8 Critical2026-06-30
LLaMA-Factory Malicious Model Path Injection Leading to Remote Code Execution
In LLaMA-Factory 0.9.5 and earlier, the WebUI module lacks input validation, resulting in a code injection (CWE-94) security flaw. An attacker supplies a malicious model path through the Chat or Training interface, and that path is passed unvalidated to AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with trust_remote_code=True hardcoded, causing the Hugging Face transformers library to fetch and execute arbitrary Python code from a remote or local model repository with server process privileges. The vulnerability affects all LLaMA-Factory users who have not updated to a patched version, particularly deployments exposing the WebUI. An attacker needs only WebUI access to trigger it and achieves remote code execution without additional user interaction.
Component
LLaMA-Factory is an open-source large language model fine-tuning framework supporting training and inference across multiple model architectures, with a WebUI for user interaction.
Risks
- Complete system control: An attacker can execute arbitrary Python code with server process privileges, gaining full control of the server including reading sensitive data, modifying configuration files or planting backdoors
- Remote code execution: By crafting a malicious model path, an attacker can cause the Hugging Face transformers library to load and execute remote code, resulting in server takeover
- No user interaction required: As long as the attacker has WebUI access (through weak credentials or internal network reach), the attack can be launched directly without luring any end user into additional actions
Source
Remediation- Deploy strict input validation in front of the WebUI interface and reject untrusted model paths
- Remove or disable the hardcoded trust_remote_code=True configuration and enable it manually only in controlled environments
