You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

PyTorch Archive vLLM trust-remote-code PoC

Benign PoC for a valid PyTorch Archive that drives TorchServe's built-in vllm_handler to enable trust_remote_code from archive-local model-config.yaml, causing bundled model-repo code to execute during model load.

Files

vllm-trust-remote-code-crafted.mar — valid minimized .mar (12.69 MB) that registers cleanly and writes a harmless marker during built-in vllm_handler initialization
build-meta.json — reproduction summary and clean-vs-crafted measurements
replay_vllm_trust_remote_code_ace.py — self-contained replay script that builds the required CPU-only TorchServe+vLLM image if needed

What it demonstrates

The built-in vllm_handler accepts archive-local handler.vllm_engine_config.trust_remote_code: true, registers the model successfully (200, worker READY), and imports attacker-controlled bundled model-repo code during load, writing VLLM_TRUST_REMOTE_CODE_TRIGGERED.

Quick repro

Run python replay_vllm_trust_remote_code_ace.py vllm-trust-remote-code-crafted.mar from this directory. The script starts TorchServe 0.12.0 with CPU vllm 0.6.1, registers the artifact, and writes the raw outputs plus marker under raw/.

This PoC is for defensive validation and bug-bounty triage only.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support