A critical code injection vulnerability in whichllm allows unauthenticated remote attackers to achieve arbitrary code execution on the host machine by manipulating HuggingFace repository filenames.

This flaw is a code injection vulnerability (CWE-94) occurring because the tool interpolates untrusted metadata from HuggingFace, specifically GGUF filenames, directly into Python source code without proper escaping. An unauthenticated remote attacker who controls a malicious repository can break out of string literals to execute arbitrary commands upon the user invoking run or snippet functions.

Successful exploitation results in full remote code execution on the user machine, potentially leading to total system compromise, data theft, or the installation of persistent malware. Given the CVSS score of 8.8, this represents a high-severity risk that could allow an attacker to pivot into internal networks or exfiltrate sensitive credentials stored on the developer workstation.

Immediate Action: Update the whichllm package to version 0.5.16 or later immediately to incorporate the necessary input sanitization and string escaping logic.

Proactive Monitoring: Review system logs for unexpected process execution originating from the whichllm binary or Python processes that interact with HuggingFace Hub APIs.

Compensating Controls: Users should avoid running whichllm against untrusted or unknown HuggingFace repositories until the software has been patched.

Public Exploit Available: No confirmed public exploit exists.

The vulnerability presents a severe risk to developers and automated systems utilizing whichllm to interact with the HuggingFace ecosystem. Organizations should prioritize the immediate update to version 0.5.16 to eliminate the code injection vector, as the impact of full system compromise outweighs the effort required for this update.