Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

abetlen/llama-cpp-python

              main @ 4ff48f0
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Code Execution: 2 prior fixes. Scrutinize any change in this area.

llama_cpp/llama_chat_format.py: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Execution: Untrusted Jinja2 chat templates can be exploited to achieve arbitrary remote code execution if parsed with standard, unrestricted Jinja2 environments. Securing this boundary requires absolute enforcement of Sandboxed Jinja environments.

Denial of Service: Cyclic dependencies between the tokenizer and model instances prevent Python's garbage collector from reclaiming heavy LLM model memory, allowing sequential model loads to exhaust host memory and crash the application.