Hugging Face's logo

phonglanvq
/
tf-legacy-lambda-rce

Model card Files
xet
 Community

You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Log in or Sign Up to review the conditions and access this model content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

TensorFlow HDF5 Security Research PoCs

This repository contains proof-of-concept .h5 model files for an authorized security audit under the huntr Model Format Vulnerability program (beta). These artifacts are for defensive validation and coordinated disclosure only, not for any production or general-purpose use.

Summary

The bundle currently contains three independent PoCs against TensorFlow's legacy Keras HDF5 loading path in the audited source tree (1d0f0c1c525442f9bb0e219ea4714ff94e56b374):

  1. legacy_lambda_rce.h5
    • Demonstrates benign load-time code execution by writing a fixed marker file in /tmp.
  2. cyclic_inbound_nodes_dos.h5
    • Demonstrates a load-time hang from cyclic Functional graph replay.
  3. oversized_weight_allocation_dos.h5
    • Demonstrates load-time allocation pressure from a tiny HDF5 file with a huge declared logical tensor.

Files

  • legacy_lambda_rce.h5, legacy_lambda_rce.py, legacy_lambda_rce_clean_repro.txt
  • cyclic_inbound_nodes_dos.h5, cyclic_inbound_nodes_dos.py, cyclic_inbound_nodes_dos_repro.txt
  • oversized_weight_allocation_dos.h5, oversized_weight_allocation_dos.py, oversized_weight_allocation_dos_repro.txt

Reproduction

Tested on July 29, 2026.

Run each PoC through the public tf.keras.models.load_model() API from a network-disabled container with:

TF_USE_LEGACY_KERAS=1 python3 <poc_script.py> <mode>

Where:

  • legacy_lambda_rce.py generates and reproduces in one run,
  • cyclic_inbound_nodes_dos.py uses generate and repro modes,
  • oversized_weight_allocation_dos.py uses generate and repro modes.

Note

These artifacts are intended only for defensive validation and coordinated disclosure workflows.

Downloads last month

-

Downloads are not tracked for this model. How to track
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support