README.md

# PoC - modelaudit GGUF array-typed chat_template SSTI detector bypass (BL-0111)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.

- Scanner: modelaudit==0.2.49 (gguf_scanner.py). Format: GGUF (.gguf).
- `modelaudit scan variant_array.gguf` -> Clean / exit 0: the tokenizer.chat_template is stored as an ARRAY-of-string (GGUF value_type 9) carrying a plaintext os.popen SSTI, which the Jinja2 SSTI detector misses. `control_string.gguf` (byte-identical payload as a STRING) fires CRITICAL - proving the detector is live. benign_string.gguf is the negative baseline.
- Root cause: gguf_scanner.py:538 gates the chat_template check on `isinstance(value, str)`, so an ARRAY value (a list) is never recorded into the templates dict fed to the Jinja2 scanner. Distinct from the earlier GGUF finding (which obfuscated inside a string template); this is a metadata value-TYPE confusion, no obfuscation.
- Benign: the SSTI payload runs `id` and writes a marker. Loader link anchored to CVE-2024-34359 (llama-cpp-python jinja render).

Files: variant_array.gguf (bypass), control_string.gguf (fires), benign_string.gguf. Full report in huntr submission.