whichllm code injection via crafted GGUF filename from attacker-controlled Hugging Face repository

whichllm before 0.5.16 contains a code injection vulnerability in its run and snippet commands: a remote attacker who controls a Hugging Face repository can craft a GGUF filename containing double quotes or other special characters that break out of the script's intended string context, achieving arbitrary code execution when a user runs whichllm against that repository.

This is a supply-chain-style attack against a niche developer CLI tool used to inspect/download GGUF models from Hugging Face — a malicious model repo can achieve code execution on a developer's machine simply by having its filename processed, but the tool has narrow deployment reach compared to core inference frameworks.

Attacker publishes a Hugging Face repo containing a GGUF file with a crafted filename that injects code when processed by whichllm's run/snippet commands

whichllm < 0.5.16

Upgrade to whichllm >= 0.5.16