The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line
The llm command-line tool (through version 0.27.1) lets users supply custom Python functions via the --functions argument, but it runs whatever code is given there using Python's exec() with no checks at all. Anyone who can get a victim to run a crafted llm command can execute arbitrary code on that victim's machine.
How the attack works
An attacker crafts an llm CLI invocation that includes a --functions argument containing malicious Python code disguised as a function definition. The attacker then uses social engineering — a shared script, a copy-pasted command in documentation, a forum post, a support ticket — to get a victim to run this command. When the victim executes it, llm passes the attacker's code straight into exec() without sanitization or sandboxing. The malicious code then runs with the victim's own privileges, on their own machine.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- cdd6681f-f620-4a5c-ae5d-0795a89f2439
- Severity
- Critical
- CVEs
- CVE-2026-31236
Why it matters
Full arbitrary code execution on any machine where a victim is tricked into running the crafted command — attackers can steal data, install further malware, or pivot to other systems, all under the victim's own account privileges.
What you can do
- →Upgrade llm past the vulnerable version as soon as a fixed release is available.
- →Treat any llm command containing a --functions argument from an untrusted source (scripts, forums, chat messages, tickets) as suspicious and inspect the code before running it.
- →Avoid running llm commands copied from external sources without reviewing every argument, especially --functions.
- →Run llm inside a restricted or sandboxed environment (limited user privileges, container, no access to sensitive credentials) so that exec()-based code execution has limited blast radius.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.