CVE-2026-108957

A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument llm_model_name_or_path results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-74
• CWE-94

• https://github.com/TinyLLaVA/TinyLLaVA_Factory/
• https://github.com/TinyLLaVA/TinyLLaVA_Factory/issues/212
• https://vuldb.com/cve/CVE-2026-108957
• https://vuldb.com/submit/997884
• https://vuldb.com/vuln/416776
• https://vuldb.com/vuln/416776/cti

Published

Oct 13, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108951LavaLite CMS through 10.1.2 contains an authorization bypass…6.5
• CVE-2026-108952RT-Thread through 5.3.0 contains a memory corruption vulnera…4.6
• CVE-2026-108953mac-shell-mcp before 2.0.0 contains an OS command injection …7.8
• CVE-2026-108954A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8…6.3
• CVE-2026-108955A vulnerability was determined in Tiiny-AI PowerInfer up to …5.3
• CVE-2026-108956A vulnerability was identified in code-projects Online Revie…7.3
• CVE-2026-108958A weakness has been identified in TensorLayer up to 2.2.4. T…6.3
• CVE-2026-108959A security vulnerability has been detected in itsourcecode O…6.3
• CVE-2026-10896Use after free in Chrome for iOS in Google Chrome on iOS pri…8.8
• CVE-2026-108960A vulnerability was detected in Tiiny-AI PowerInfer up to 8b…5.3
• CVE-2026-108961A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. A…6.3
• CVE-2026-108962A vulnerability has been found in storyicon comfyui_segment_…6.3