llama-cpp-python Jinja2 SSTI in chat_template metadata -> RCE (Llama Drama)
Date: 2024-05
Affected: llama-cpp-python < 0.2.72
Attack vector: deserialization
Category: real-world
Severity: Critical
CVE: CVE-2024-34359
CWE: CWE-76
CVSS: 9.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

Jinja2ChatFormatter parses chat_template from .gguf model metadata with a sandbox-less jinja2.Environment, enabling SSTI -> RCE. Over 6,000 HuggingFace models affected. CVSSv3 9.7. Fixed in v0.2.72.


Mitigations:

Architectural layers (MAESTRO):