tags:
- huntr
- protectai
- triage
- security-research
license: other
ProtectAI / Huntr PoC Repository Index
This repository was originally used as a placeholder while protectai-bot could not be granted Hugging Face gated access.
The workflow is now working again. Please use the finding-specific repositories below.
ONNX — ONNX Runtime Tile Bomb
Report: 111-byte ONNX Runtime Tile Bomb Bypasses check_model() and Kills Memory-Capped Inference Workers
Model / PoC repo:
https://huggingface.co/01data-ai/onnx_runtime_f002_tile_bomb
ONNX — external_data Hash-DotDot Validator Bypass
Report: ONNX external_data Validator Bypass Enables Same-Base File Ingestion via #../ Path Normalization
Model / PoC repo:
https://huggingface.co/01data-ai/onnx_f003_hash_dotdot_validator_bypass
Joblib — NDArrayWrapper Path Traversal
Report: Joblib Model Load Path Traversal Reads External .npy Files via NDArrayWrapper.filename
Model / PoC repo:
https://huggingface.co/01data-ai/joblib_f002_path_traversal_poc
Joblib — Compressed Loader DoS
Report: Joblib Compressed Loader DoS via BinaryZlibFile unused_data Re-Feed OOM Loop
Model / PoC repo:
https://huggingface.co/01data-ai/joblib_f003_unused_data_oom_dos
Joblib — Memmapping context_id Path Traversal
Report: Joblib memmapping context_id Path Traversal Escapes Temp Root and Deletes Outside Directory
Model / PoC repo:
https://huggingface.co/01data-ai/joblib_f005_memmapping_context_traversal
GGUF — Nested ARRAY Recursion DoS
Report: Python GGUFReader Allows Deeply Nested ARRAY Metadata to Trigger RecursionError DoS
Model / PoC repo:
https://huggingface.co/01data-ai/gguf_py_f001_nested_array_recursion
GGUF — uint64/int64 Count Divergence
Report: Python GGUFReader Misinterprets Signed Header Counts as uint64, Causing Parser Divergence and Crash
Model / PoC repo:
https://huggingface.co/01data-ai/gguf_py_f002_uint64_int64_count_divergence
GGUF — Tensor Offset Aliasing
Report: Python GGUFReader Accepts Overlapping Tensor Offsets, Causing Silent Tensor Data Aliasing
Model / PoC repo:
https://huggingface.co/01data-ai/gguf_py_f004_tensor_offset_aliasing
SafeTensors — Zero-Size Offset Bypass
Report: Validation Invariant Bypass in Metadata::validate() Allows Zero-Size Tensor to Reuse a Data Offset
Model / PoC repo:
https://huggingface.co/01data-ai/safetensors_f002_zero_size_offset_bypass
SafeTensors — F4 NumPy Crash
Report: F4 Dtype Load Crash in SafeTensors NumPy Path via Unguarded numpy.float4_e2m1fn_x2 Lookup
Model / PoC repo:
https://huggingface.co/01data-ai/safetensors_f003_f4_numpy_crash
MLflow — loader_module Guard Bypass RCE
Report: MLflow PyFunc loader_module Injection Executes Attacker Code Despite Pickle Deserialization Disabled
Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f002_loader_module_guard_bypass_rce
MLflow — sklearn pickled_model Path Traversal RCE
Report: MLflow sklearn pickled_model Path Traversal Enables Cloudpickle RCE via load_model()
Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f003_sklearn_pickled_model_path_traversal_rce
MLflow — PyTorch pickle_module_info Pre-Guard RCE
Report: MLflow PyTorch pickle_module_info.txt Module Injection Executes Code Before Pickle Guard
Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f005_pytorch_pickle_module_info_preguard_rce
MLflow — PyTorch weights_only=False RCE
Report: MLflow PyTorch Hardcodes weights_only=False, Re-Enabling Cloudpickle RCE on PyTorch 2.6+
Model / PoC repo:
https://huggingface.co/01data-ai/mlflow_f006_pytorch_weights_only_false_rce