# Risk map — ggml-org/llama.cpp

> Canonical page: https://codevetter.com/unpack/llama-cpp/risk-map

# Risk map — ggml-org/llama.cpp

Scanned commit 7ab4ee7baad2d920464cbacfad4f4b07cf111fd2 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Biggest risks: server-side command execution features (exec_shell_command, MCP stdio subprocesses, router child spawning, CORS proxy) which are opt-in but powerful; unauthenticated-by-default HTTP API; remote content trust (HF downloads, remote presets, prebuilt UI assets); and a very large single-threaded decode loop in server-context.cpp (~5.5k lines) where a fatal error aborts all slots. GGML_ABORT/GGML_ASSERT turn many error paths into crashes rather than graceful failures.
- exec_shell_command is a built-in server tool that runs arbitrary shell commands via run_subprocess (sheredom subprocess.h, subprocess_option_search_user_path|inherit_environment); an 'isolate' mode can redirect file/exec ops through a container or remote host transport — gated behind --tools/--tools-runtime which the server logs as experimental security warnings. — [tools/server/server-tools.cpp#L187-207](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-tools.cpp#L187-L207) [tools/server/server-tools.cpp#L516-624](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-tools.cpp#L516-L624) [tools/server/server-tools.cpp#L1239-1247](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-tools.cpp#L1239-L1247) [tools/server/server.cpp#L350-380](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server.cpp#L350-L380)
- MCP integration spawns arbitrary configured commands as stdio subprocesses (server_mcp_stdio wraps common_subproc) with ndjson JSON-RPC over stdin/stdout; MCP server configs can be supplied as JSON including Cursor 'mcpServers' format. — [tools/server/server-mcp.cpp#L340-351](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-mcp.cpp#L340-L351) [tools/server/server-mcp.cpp#L132-176](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-mcp.cpp#L132-L176) [common/subproc.cpp#L30-49](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/common/subproc.cpp#L30-L49)
- Router mode spawns child llama-server processes with attacker-influenceable args (model params come from HTTP /models/load requests); it requires LLAMA_SUBPROCESS and throws when subprocess support is compiled out. — [tools/server/server-models.cpp#L1163-1189](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-models.cpp#L1163-L1189) [tools/server/server-models.cpp#L1923-1924](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-models.cpp#L1923-L1924) [CMakeLists.txt#L104-110](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/CMakeLists.txt#L104-L110)
- Auth is optional: API keys come from --api-key/--api-key-file (LLAMA_ARG_API_KEY env); the server only warns (not fails) when cors_origins='*' with no keys, and prints 'do not expose to untrusted environments' warnings for router/tools/MCP features. — [common/arg.cpp#L3484-3505](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/common/arg.cpp#L3484-L3505) [tools/server/server.cpp#L324-341](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server.cpp#L324-L341) [tools/server/server.cpp#L373-380](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server.cpp#L373-L380)
- A /cors-proxy endpoint proxies arbitrary GET/POST requests when --ui-mcp-proxy is enabled (experimental, used by the Web UI for MCP), effectively an open proxy surface on the server port. — [tools/server/server.cpp#L328-341](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server.cpp#L328-L341) [tools/server/server-cors-proxy.h](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-cors-proxy.h)
- Remote model handling trusts network content: -hf downloads GGUFs and preset .ini files from HF (with an explicit 'only use presets that you can trust' warning), and LLAMA_USE_PREBUILT_UI pulls UI assets from a HF bucket at build time. — [tools/server/server.cpp#L520-524](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server.cpp#L520-L524) [common/download.cpp](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/common/download.cpp) [tools/ui/CMakeLists.txt#L1-37](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/ui/CMakeLists.txt#L1-L37)
- `llama update` shells out: on LLAMA_INSTALL_BUILD it runs system('curl ... | sh') or powershell irm|iex against https://llama.app — a code-execution path dependent on TLS and remote server integrity. — [app/llama.cpp#L27-41](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/app/llama.cpp#L27-L41)
- Error handling frequently escalates to process abort: GGML_ABORT/GGML_ASSERT appear on hot paths (e.g. >3 consecutive empty decode batches aborts; model not implementing llama_model_base aborts), so malformed inputs or edge states can take down the whole server rather than one request. — [tools/server/server-context.cpp#L3652-3662](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-context.cpp#L3652-L3662) [src/llama.cpp#L332-335](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/src/llama.cpp#L332-L335) [tools/server/server-context.cpp#L4395-4398](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-context.cpp#L4395-L4398)
- Decode failure blast radius: when llama_decode returns nonzero, decode() sends errors to ALL processing slots and clears the entire context per-slot ('it's complicated to keep track of how much of the current batch has been processed'), so one bad request can kill concurrent sessions. — [tools/server/server-context.cpp#L3688-3719](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-context.cpp#L3688-L3719)
- server-context.cpp is a 5,558-line pimpl monolith owning slots, batching, checkpointing, prompt cache, metrics, LoRA, speculative decode and all route handlers — high coupling makes regressions likely; code comments admit 'alora handling is too messy, need to refactor'. — [tools/server/server-context.cpp#L2853](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-context.cpp#L2853) [tools/server/server-context.cpp](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-context.cpp)
- GGUF/mmap input parsing is a trust boundary: llama_model_loader and gguf.cpp parse arbitrary model files (metadata strings, tensor offsets) and mmap them directly; params.check_tensors exists but untrusted model files remain a memory-safety attack surface. (inferred) — [src/llama-model-loader.cpp#L1-30](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/src/llama-model-loader.cpp#L1-L30) [src/llama-mmap.cpp](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/src/llama-mmap.cpp) [ggml/src/gguf.cpp](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/ggml/src/gguf.cpp)
- SSL is optional and off unless CPPHTTPLIB_OPENSSL_SUPPORT is compiled in AND both --ssl-key-file/--ssl-cert-file are given; otherwise the API (including Bearer keys) runs plaintext HTTP — default port :8080 with a pending change to :9931. — [tools/server/server-http.cpp#L107-124](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-http.cpp#L107-L124) [CMakeLists.txt#L144](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/CMakeLists.txt#L144) [tools/server/server.cpp#L514-518](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server.cpp#L514-L518)
- Debug/env side-channels: LLAMA_TRACE, LLAMA_SERVER_SLOTS_DEBUG, LLAMA_SERVER_SLOTS_N_DIFF change runtime behavior; --prompts-log-dir writes every prompt to disk (path_prompts_log_dir); prompts are also logged at debug level. — [tools/server/server-context.cpp#L1316-1341](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-context.cpp#L1316-L1341) [tools/server/server-context.cpp#L4281-4289](https://github.com/ggml-org/llama.cpp/blob/7ab4ee7baad2d920464cbacfad4f4b07cf111fd2/tools/server/server-context.cpp#L4281-L4289)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)