You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

PyTorch Package load_pickle Arbitrary Code Execution

This PoC demonstrates arbitrary command execution when a PyTorch package loads an attacker-controlled pickle entry through torch.package.PackageImporter.load_pickle().

The crafted .pt package is created with torch.package.PackageExporter and contains model/payload.pkl. Loading that pickle with PackageImporter.load_pickle("model", "payload.pkl") invokes Python pickle deserialization and executes the payload.

Files

malicious_torch_package.pt - crafted PyTorch package containing the malicious pickle entry.
build_and_verify.py - builds the package and verifies execution.
verify_report.json - local verification output.

Reproduction

Run:

python build_and_verify.py

Expected results:

malicious_torch_package.pt is created.
PackageImporter.load_pickle("model", "payload.pkl") loads the pickle entry.
pytorch_package_rce_marker.txt is created.
The marker contains PYTORCH_PACKAGE_RCE.

Impact

Any application that accepts an untrusted PyTorch package and loads a pickle entry from it with PackageImporter.load_pickle() can execute attacker-controlled code in the Python process.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support