Fix: replace non-ASCII dashes with ASCII to prevent encoding issues

README.md

@@ -5,16 +5,16 @@ tags:
 - proof-of-concept
 ---
 
-# PoC: RWKVTokenizer eval() — Arbitrary Code Execution via `.keras` Model File
+# PoC: RWKVTokenizer eval() - Arbitrary Code Execution via .keras Model File
 
 **Vulnerability:** `eval()` on attacker-controlled vocabulary in `keras_hub.models.RWKVTokenizer`
-**Affected:** keras-hub 0.26.0 – 0.28.0 | keras 3.9.0 – 3.12.1
+**Affected:** keras-hub 0.26.0 to 0.28.0 | keras 3.9.0 to 3.12.1
 **CWE:** CWE-95 (Eval Injection)
 **Bypasses:** `safe_mode=True` (keras default)
 
 ## What this repo contains
 
-`malicious_rwkv_tokenizer.keras` — a crafted `.keras` model archive.
+`malicious_rwkv_tokenizer.keras` - a crafted `.keras` model archive.
 When loaded with `keras.models.load_model()`, the `vocabulary` field in `config.json`
 reaches `eval()` inside `RWKVTokenizerBase.__init__` (line 117) and
 `RWKVTokenizer.set_vocabulary` (line 275) in `rwkv7_tokenizer.py`.
@@ -33,11 +33,11 @@ import keras
 import keras_hub  # required: registers keras_hub>RWKVTokenizer in Keras object registry
 
 model = keras.models.load_model("malicious_rwkv_tokenizer.keras", safe_mode=True)
-# eval() fires during load — marker written to tempdir, no exception raised
+# eval() fires during load - marker written to tempdir, no exception raised
 ```
 
 **Note:** `keras_hub` must be imported before `load_model()`. This is satisfied
-automatically in any real deployment using keras_hub models — the attack prerequisite
+automatically in any real deployment using keras_hub models - the attack prerequisite
 is standard, not exceptional.
 
 **Note on tensorflow_text:** `assert_tf_libs_installed()` is a functional deployment
@@ -50,10 +50,10 @@ tokenizer in production).
 `rwkv7_tokenizer.py` calls `eval()` on every vocabulary entry string:
 
 ```python
-# line 117 — RWKVTokenizerBase.__init__
+# line 117 - RWKVTokenizerBase.__init__
 x = eval(line[line.index(" ") : line.rindex(" ")])
 
-# line 275 — RWKVTokenizer.set_vocabulary
+# line 275 - RWKVTokenizer.set_vocabulary
 repr_str = eval(line[line.index(" ") : line.rindex(" ")])
 ```