YAML Metadata Warning: empty or missing yaml metadata in repo card (https://huggingface.co/docs/hub/model-cards#model-card-metadata)

PoC: wandb Launch Command Injection (CWE-78)

Vulnerability

The wandb Python SDK (v0.24.2) Launch feature constructs Docker commands where entry_cmd and additional_args are NOT shell-quoted, but the result is passed to bash -c for execution. Shell metacharacters enable command injection.

Affected Code

#	File	Line	Issue
1	`local_container.py`	290	`entry_cmd[0]` not quoted
2	`local_container.py`	293	`entry_cmd[1:]` not quoted
3	`local_container.py`	295	`additional_args` not quoted
4	`local_process.py`	69	`entry_point.command` not quoted

Inconsistency: env_vars and docker_args ARE properly quoted with shlex.quote().

Running the PoC

pip install wandb
python3 poc_wandb_cmd_injection.py

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support