Kanisia/hdf5-externallink-read-modelscan-bypass

HDF5 ExternalLink File Read ModelScan Bypass

Target

HDF5 model format.

Summary

hdf5_external_link_read.h5 is a small HDF5 file containing an ExternalLink object named linked_secret. The link points to linked_secret.h5:/secret.

When downstream tooling dereferences linked_secret, HDF5 opens the external HDF5 file and reads the target dataset. ModelScan reports no issues and skips the file because it does not find a Keras model config.

Files

• hdf5_external_link_read.h5: PoC model file to upload to Hugging Face.
• linked_secret.h5: Reproduction fixture read through the HDF5 ExternalLink.
• build_and_verify.py: Builds the HDF5 files and verifies link metadata, external-link read behavior, and ModelScan result.
• verify_report.json: Verification output from the local run.

Reproduction

& C:\Users\mean\Desktop\bbg\.venv\Scripts\python.exe C:\Users\mean\Desktop\bbg\poc-hdf5-external-link-read\build_and_verify.py

Expected result:

• HDF5 model size is 6144 bytes.
• object linked_secret is an HDF5 ExternalLink.
• ExternalLink filename is linked_secret.h5.
• ExternalLink target path is /secret.
• dereferencing h5["linked_secret"] reads HDF5_EXTERNAL_LINK_READ_MARKER.
• ModelScan reports no issues and skips the file as MODEL_CONFIG not found.

Impact

An attacker can publish an HDF5 model artifact that contains external links to other HDF5 files or paths. Downstream tooling that traverses or dereferences objects in the HDF5 model can be caused to open external files referenced by the model metadata. Scanners should surface HDF5 ExternalLink objects before model loading, traversal, or dataset access.