You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

coreml-mlpackage-path-traversal-poc

PoC files for a .mlpackage path traversal in coremltools (tested 9.0, Linux), reachable from the plain MLModel("x.mlpackage") call.

an .mlpackage is a bundle with a Manifest.json that points at the root model by a path field. on load, coremltools does a lexical packagePath + "/Data/" + manifest_path join (coremltools/models/utils.py:265) with no sanitizing, then open(specfile,"rb").read() + ParseFromString (utils.py:270-271). so an absolute path or a stack of ../ in that field walks out of the bundle and coremltools opens whatever file you name, at load, on a normal Linux host (the pure-python path — _MLModelProxy is None off-mac).

files

dos_dev_zero.mlpackage — Manifest path → /dev/zero. loading it makes f.read() spin forever → memory exhaustion, host OOM if uncapped. strongest concrete impact.
traversal_etc_hostname.mlpackage — Manifest path → /etc/hostname (an absolute path outside the bundle). loading it opens+parses a file that has nothing to do with the package. swap the path for anything the process can read.
poc.py — one script showing all of it: traversal (load a spec from outside the bundle), arbitrary-path existence oracle, and the /dev/zero DoS.

repro

pip install coremltools==9.0
python poc.py

the bytes it reads get ParseFromString'd into a Model proto and aren't handed back, so it's not clean content exfil — impact is DoS + arbitrary-path open / existence-probe, not full file read. no write, no code exec.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support