phonglanvq/pytorch-load-state-dict-rce-poc

PyTorch load_state_dict_from_url PoC

This repository is a security research PoC for PyTorch checkpoint loading.

It is intentionally malicious and is meant only for authorized vulnerability reproduction inside an isolated sandbox.

Files

• evil.pt
  • direct malicious PyTorch checkpoint
• outer.zip
  • one-member wrapper zip containing evil.pt
• outer_noext.zip
  • one-member wrapper zip containing the same malicious checkpoint as payload.bin
• repro_hub_default_rce.py
  • direct public-API repro for torch.hub.load_state_dict_from_url
• repro_hub_scanner_bypass.py
  • builds the wrapper-zip variants used for scanner/runtime mismatch testing

Vulnerable API

torch.hub.load_state_dict_from_url(url)

In the audited PyTorch source, this helper still defaults weights_only=False and forwards that value into torch.load.

Expected Behavior

Loading evil.pt through torch.hub.load_state_dict_from_url(file://...) executes the pickle payload.

Loading outer_noext.zip through the same helper executes after the helper unwraps the single-member outer zip and loads the extracted inner checkpoint.

The payload writes a marker file at:

/tmp/hf_repo_marker

Minimal Reproduction

Run inside an isolated, network-disabled sandbox with a PyTorch runtime installed:

/tmp/venv/bin/python repro_hub_default_rce.py

Or directly:

import torch
print(
    torch.hub.load_state_dict_from_url(
        "file:///absolute/path/to/outer_noext.zip",
        model_dir="/tmp/hub-cache",
    )
)

Then verify:

cat /tmp/hf_repo_marker

Scanner Notes

In this audit:

• raw evil.pt was detected by picklescan and modelscan
• outer.zip and outer_noext.zip were not flagged equivalently by the installed scanner stack
• runtime still accepted and executed the wrapped payload

Safety

Do not run these files outside an isolated sandbox.