You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

PoC: arbitrary file read when loading a .surml model

Proof of concept for a huntr model file vulnerability report. It is harmless: it reads a marker file you place in the working directory, to show the read primitive without touching real data.

Files:

poc_exfil.surml — its ONNX initializer sets external_data.location=surml_poc_marker.txt, so loading the model reads that file and returns its bytes as output.
control_benign.surml — same graph, inline weights, reads nothing.
build_surml.py — rebuilds both and checks them.

Run:

pip install onnxruntime
python3 build_surml.py

poc_exfil.surml output matches the marker file; the control reads nothing. The script also shows reading /etc/hostname (absolute path) and ../ traversal.

A .surml from an untrusted source (e.g. an ml import upload) can read files readable by the loading process. Do not use against systems you do not own.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support