llama.cpp WebUI query param enables CSRF tool runs

The Web UI in llama-server treats a URL query parameter as the first message of a new conversation and submits it automatically. That turns an ordinary link into a cross-site request forgery path against anyone running the server with the interface left on.

An attacker who gets a victim to open a crafted URL can force an arbitrary initial prompt. When built-in tools are enabled, the model may call them. If the user has already chosen to always allow tool execution without prompts, the server host can run shell commands, read files for exfiltration, or take other tool-backed actions depending on the configuration.

The problem hits llama-server setups that keep the default Web UI and turn tools on, especially with broad allow settings. Risk drops by disabling the Web UI, leaving tools off, or requiring confirmation before each tool call. The issue was reported against the ggml-org llama.cpp project.