Upload folder using huggingface_hub

README.md

@@ -0,0 +1,32 @@
+# llama.cpp torch.load() RCE PoC
+
+## Vulnerability
+Multiple conversion scripts in llama.cpp use `torch.load()` without `weights_only=True`, allowing arbitrary code execution.
+
+## Affected Files
+- `tools/mtmd/legacy-models/glmedge-convert-image-encoder-to-gguf.py`
+- `tools/mtmd/legacy-models/minicpmv-convert-image-encoder-to-gguf.py`
+- `tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py`
+
+## PoC
+`malicious_projector.pt` contains a pickle payload that executes `touch /tmp/llama_cpp_rce_poc` when loaded.
+
+## Reproduction
+```bash
+git clone https://github.com/ggml-org/llama.cpp
+cd llama.cpp
+
+python tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py \
+    --llava-projector path/to/malicious_projector.pt \
+    --model-dir /tmp
+
+ls /tmp/llama_cpp_rce_poc  # File created = RCE
+```
+
+## Impact
+RCE when users convert untrusted PyTorch models to GGUF format.
+
+## Fix
+```python
+projector = torch.load(args.llava_projector, weights_only=True)
+```

malicious_projector.pt

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b975ecf92eaf178254d08732422ecf238a9ebf38cbbbcf1edf6a654a30184471
+size 2053