Neto7z/glm4v-moe-rce-poc

⚠️ SECURITY RESEARCH - MALICIOUS MODEL POC

🚨 WARNING: DO NOT USE IN PRODUCTION

This is a proof-of-concept malicious model created for responsible security disclosure.

Purpose: Demonstrate arbitrary code execution vulnerability in Hugging Face Transformers (GLM4V-MoE / GLM4V weight converters) Program: Huntr Bug Bounty (MFV - Model File Vulnerabilities) Severity: CRITICAL (CVSS 9.6) Status: Responsible disclosure — reported to maintainers

---

Vulnerability Details

Summary

This model contains a weaponized model_optim_rng.pt pickle file (inside mp_rank_00/) that executes arbitrary code when the transformers library's GLM4V-MoE conversion script loads it with torch.load(..., weights_only=False) — without any user warning or TRUST_REMOTE_CODE validation.

Affected Code

File: src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py Line: 275

file_path = item / "model_optim_rng.pt"
assert file_path.exists(), f"model_optim_rng.pt not found in {item}"

file_sd = torch.load(file_path, map_location="cpu", weights_only=False)  # ❌ UNSAFE!

Same flaw (non-MoE sister): src/transformers/models/glm4v/convert_glm4v_mgt_weights_to_hf.py line 322.

Aggravating factor: both scripts monkeypatch pickle.Unpickler (lines 27–39) with an UnpicklerWrapper whose find_class only blocks modules starting with megatron/glm/__main__ — all other modules (e.g. os, builtins, subprocess) resolve normally via super().find_class(). This is a compatibility shim ("Avoid Using Megatron Lib"), not a security control.

Proof of Exploitation

When this model is converted using the official conversion script:

python src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py \
    --model_path ./glm4v-moe-rce-poc \
    --output_path ./converted

What happens:

1. ✅ Conversion script loads mp_rank_00/model_optim_rng.pt with torch.load(..., weights_only=False)
2. ✅ Pickle exploit triggers via Python's __reduce__ magic method
3. ✅ Arbitrary code executes (creates /tmp/pwned_glm4v_moe)
4. ✅ NO WARNING shown to user
5. ✅ NO TRUST_REMOTE_CODE check required

Result: Full arbitrary code execution with the converter process's privileges.

Security Impact

CVSS Score: 9.6 (Critical) Attack Vector: Network (AV:N) Attack Complexity: Low (AC:L) Privileges Required: None (PR:N) User Interaction: Required (UI:R) Scope: Changed (S:C) Confidentiality: High (C:H) Integrity: High (I:H) Availability: High (A:H)

Impact:

• 🔴 Arbitrary code execution at conversion time
• 🔴 Full system compromise
• 🔴 Data exfiltration (SSH keys, credentials, API tokens)
• 🔴 Persistent backdoor installation
• 🔴 Supply chain attack vector

ProtectAI Scanner Consideration

This malicious checkpoint is loaded by the conversion script path, not the main model-loading path (from_pretrained). Model security scanners (e.g. ProtectAI) that inspect .pkl/.safetensors weight files do not flag model_optim_rng.pt inside a megatron checkpoint layout, and the converter has no TRUST_REMOTE_CODE gate.

---

Responsible Disclosure

Disclosure Timeline

• Discovery Date: 2026-08-15
• Disclosure Platform: Huntr (https://huntr.com)
• Program: Model File Vulnerabilities (MFV)
• Status: Reported to maintainers
• CVE: Pending assignment

Affected Versions

• ✗ Hugging Face Transformers: >= 4.57.2 (2025-11-24) up to current master (2026-08-15)
• ✗ Affected Models: GLM4V / GLM4V-MoE Megatron checkpoints requiring conversion

Remediation

Immediate Fix:

# BEFORE (UNSAFE) — glm4v_moe:275 / glm4v:322:
file_sd = torch.load(file_path, map_location="cpu", weights_only=False)

# AFTER (SAFE):
file_sd = torch.load(file_path, map_location="cpu", weights_only=True)

If arbitrary objects are genuinely required, gate the load behind an explicit user opt-in (--trust-remote-code style), matching the pattern already used in convert_olmo_hybrid_weights_to_hf.py / convert_maskformer_swin_to_pytorch.py.

---

⚠️ This repository contains intentionally malicious content. Download and execute at your own risk, for testing only on isolated systems.