A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This issue arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on the host system. The problem is caused by insecure usage of the `Popen` function with `shell=True`, coupled with unsanitized user input. This vulnerability enables attackers to execute arbitrary OS commands on the server, potentially compromise sensitive data or escalate privileges, and deploy malware or create persistent backdoors in the system, significantly increasing the risk of data breaches and operational disruption.