ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): shell injection in GGML export conversion (#4768)

Browse source 
* Fix shell injection in GGML conversion paths

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* Remove test file from security fix PR

Move test_save_shell_injection.py to a separate PR to keep this PR focused on the security fix itself.

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Daniel Han <danielhanchen@gmail.com>
This commit is contained in:
mateeaaaaaaa 2026-04-02 10:10:43 +03:00 • committed by GitHub
commit 752cef3299
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 16 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

26
unsloth/save.py
View file

@ -2533,12 +2533,15 @@ def unsloth_convert_lora_to_ggml_and_push_to_hub(
)
print(f"The output file will be {output_file}")
command = f"python3 llama.cpp/convert-lora-to-ggml.py {lora_directory_push} {output_file} llama"
try:
with subprocess.Popen(
command,
shell = True,
[
sys.executable,
"llama.cpp/convert-lora-to-ggml.py",
lora_directory_push,
output_file,
"llama",
],
stdout = subprocess.PIPE,
stderr = subprocess.PIPE,
bufsize = 1,
@ -2550,7 +2553,7 @@ def unsloth_convert_lora_to_ggml_and_push_to_hub(
print(line, end = "", flush = True)
sp.wait()
if sp.returncode != 0:
raise subprocess.CalledProcessError(sp.returncode, command)
raise subprocess.CalledProcessError(sp.returncode, sp.args)
except subprocess.CalledProcessError as e:
print(f"Error: Conversion failed with return code {e.returncode}")
return
@ -2612,12 +2615,15 @@ def unsloth_convert_lora_to_ggml_and_save_locally(
)
print(f"The output file will be {output_file}")
command = f"python3 llama.cpp/convert-lora-to-ggml.py {save_directory} {output_file} llama"
try:
with subprocess.Popen(
command,
shell = True,
[
sys.executable,
"llama.cpp/convert-lora-to-ggml.py",
save_directory,
output_file,
"llama",
],
stdout = subprocess.PIPE,
stderr = subprocess.PIPE,
bufsize = 1,
@ -2629,7 +2635,7 @@ def unsloth_convert_lora_to_ggml_and_save_locally(
print(line, end = "", flush = True)
sp.wait()
if sp.returncode != 0:
raise subprocess.CalledProcessError(sp.returncode, command)
raise subprocess.CalledProcessError(sp.returncode, sp.args)
except subprocess.CalledProcessError as e:
print(f"Error: Conversion failed with return code {e.returncode}")
return