You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

ProtectAI / Huntr PoC Repository Index

This repository was originally used as a placeholder while protectai-bot could not be granted Hugging Face gated access.

The workflow is now working again. Please use the finding-specific repositories below.

ONNX — ONNX Runtime Tile Bomb

Report: 111-byte ONNX Runtime Tile Bomb Bypasses check_model() and Kills Memory-Capped Inference Workers

Model / PoC repo:
https://huggingface.co/01data-ai/onnx_runtime_f002_tile_bomb

ONNX — external_data Hash-DotDot Validator Bypass

Report: ONNX external_data Validator Bypass Enables Same-Base File Ingestion via #../ Path Normalization

Model / PoC repo:
https://huggingface.co/01data-ai/onnx_f003_hash_dotdot_validator_bypass

Joblib — NDArrayWrapper Path Traversal

Report: Joblib Model Load Path Traversal Reads External .npy Files via NDArrayWrapper.filename

Model / PoC repo:
https://huggingface.co/01data-ai/joblib_f002_path_traversal_poc

Joblib — Compressed Loader DoS

Report: Joblib Compressed Loader DoS via BinaryZlibFile unused_data Re-Feed OOM Loop

Model / PoC repo:
https://huggingface.co/01data-ai/joblib_f003_unused_data_oom_dos

Joblib — Memmapping context_id Path Traversal

Report: Joblib memmapping context_id Path Traversal Escapes Temp Root and Deletes Outside Directory

Model / PoC repo:
https://huggingface.co/01data-ai/joblib_f005_memmapping_context_traversal

GGUF — Nested ARRAY Recursion DoS

Report: Python GGUFReader Allows Deeply Nested ARRAY Metadata to Trigger RecursionError DoS

Model / PoC repo:
https://huggingface.co/01data-ai/gguf_py_f001_nested_array_recursion

GGUF — uint64/int64 Count Divergence

Report: Python GGUFReader Misinterprets Signed Header Counts as uint64, Causing Parser Divergence and Crash

Model / PoC repo:
https://huggingface.co/01data-ai/gguf_py_f002_uint64_int64_count_divergence

GGUF — Tensor Offset Aliasing

Report: Python GGUFReader Accepts Overlapping Tensor Offsets, Causing Silent Tensor Data Aliasing

Model / PoC repo:
https://huggingface.co/01data-ai/gguf_py_f004_tensor_offset_aliasing

SafeTensors — Zero-Size Offset Bypass

Report: Validation Invariant Bypass in Metadata::validate() Allows Zero-Size Tensor to Reuse a Data Offset

Model / PoC repo:
https://huggingface.co/01data-ai/safetensors_f002_zero_size_offset_bypass

SafeTensors — F4 NumPy Crash

Report: F4 Dtype Load Crash in SafeTensors NumPy Path via Unguarded numpy.float4_e2m1fn_x2 Lookup

Model / PoC repo:
https://huggingface.co/01data-ai/safetensors_f003_f4_numpy_crash

MLflow — loader_module Guard Bypass RCE

Report: MLflow PyFunc loader_module Injection Executes Attacker Code Despite Pickle Deserialization Disabled

Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f002_loader_module_guard_bypass_rce

MLflow — sklearn pickled_model Path Traversal RCE

Report: MLflow sklearn pickled_model Path Traversal Enables Cloudpickle RCE via load_model()

Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f003_sklearn_pickled_model_path_traversal_rce

MLflow — PyTorch pickle_module_info Pre-Guard RCE

Report: MLflow PyTorch pickle_module_info.txt Module Injection Executes Code Before Pickle Guard

Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f005_pytorch_pickle_module_info_preguard_rce

MLflow — PyTorch weights_only=False RCE

Report: MLflow PyTorch Hardcodes weights_only=False, Re-Enabling Cloudpickle RCE on PyTorch 2.6+

Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f006_pytorch_weights_only_false_rce

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support