Gguf Ssti

research.jfrog.com • April 20, 2026

A GGUF model may contain a Jinja2 template which may cause server-side template injection ( SSTI ) that leads to execution of malicious Python code when the model is loaded.

Important Note - The only publicly known case where loading a GGUF model leads to dangerous server-side template injection is related to the CVE-2024-34359 ("Llama Drama") vulnerability. This vulnerability is only exploitable when loading a GGUF model using a vulnerable version of the llama-cpp-python library ( llama-cpp-python = 0.2.72 or into other GGUF-compatible libraries, such as ollama .

The GGUF model format is a binary format optimized for quickly loading and storing models. One of the features of the GGUF model format, is the ability to store a chat template in the Model's metadata ( tokenizer.chat_template ).

A chat template simply defines how a chat (prompt) interaction with the model will look like. The chat template in a GGUF model is written using the Jinja2 template language. Since the Jinja2 template language supports execution of arbitrary Python code, loading arbitrary Jinja2 templates from a GGUF model into an unsandboxed Jinja2 engine leads to arbitrary code execution.

For example - the following Jinja2 template, which can be inserted into a GGUF model's chat_template metadata parameter, will run the shell command touch /tmp/retr0reg if the GGUF model is loaded in an unsandboxed environment -

To safely determine if the suspected GGUF model contains a malicious Jinja2 template -

JFrog conducts metadata extraction and detailed analysis on each GGUF model in order to determine whether any malicious code is present.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability Discovered in SGLang Framework via GGUF Models A remote code execution vulnerability has been identified in the SGLang framework, specifically affecting the reranking endpoint (/v1/rerank) and tracked as CVE-2026-5760. This flaw allows attackers to exploit maliciously crafted GGUF model files containing Jinja2 templates, leading to the execution of arbitrary Python code on the server. The vulnerability arises from the unsandboxed use of jinja2.Environment() in the rendering process of chat templates. Successful exploitation could result in host compromise, lateral movement, data exfiltration, or denial-of-service attacks. The issue affects deployments of SGLang that expose the vulnerable interface to untrusted networks. Despite attempts to coordinate with project maintainers, no response or patch has been issued. The severity of this vulnerability is underscored by its potential impact on enterprise AI deployments. Security researchers recommend using ImmutableSandboxedEnvironment to mitigate the risk of exploitation. 7 sources 70

Extracted Entities

Gguf Ssti

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (3)

Vulnerabilities (1)