YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
Security PoC โ mljar-supervised CWE-502 joblib RCE (huntr MFV, responsible disclosure)
Benign proof-of-concept saved AutoML results folder for a responsible-disclosure report to huntr.com.
Loading + predicting with this folder executes attacker code via joblib.load of the learner artifact
1_DecisionTree/learner_fold_0.decision_tree (supervised/algorithms/sklearn.py:53).
Reproduce:
import numpy as np; from supervised import AutoML
AutoML(results_path="<this dir>").predict(np.random.rand(5,4)) # -> joblib.load -> os.system -> RCE
Payload is harmless: writes /tmp/MLJAR_RCE_POC.txt only. Gated for protectai-bot review.
- Downloads last month
- -
Inference Providers NEW
This model isn't deployed by any Inference Provider. ๐ Ask for provider support