[patch] Patch remote OS command injection vulnerability

hiyouga · Nov 21, 2024 · aa6a174 · aa6a174
1 parent c8f1998
commit aa6a174
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/src/llamafactory/webui/runner.py b/src/llamafactory/webui/runner.py
@@ -320,7 +320,12 @@ def _launch(self, data: Dict["Component", Any], do_train: bool) -> Generator[Dic
             if args.get("deepspeed", None) is not None:
                 env["FORCE_TORCHRUN"] = "1"
 
-            self.trainer = Popen(f"llamafactory-cli train {save_cmd(args)}", env=env, shell=True)
+            cmd = [
+                "llamafactory-cli",
+                "train", 
+                *save_cmd(args).split(),
+            ]
+            self.trainer = Popen(cmd, env=env)
             yield from self.monitor()
 
     def _form_config_dict(self, data: Dict["Component", Any]) -> Dict[str, Any]: