AV07/mlflow-dspy-pickle-bypass-poc

Updated May 15

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe malicious_model/data/model/program.pkl (; av suspicious)

Ajmax/shap-pickle-rce-poc

Updated Jul 4

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe malicious_explainer.pkl (; av suspicious)

AnoAuthor1/MaliciousModel

Updated Aug 22, 2025

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe evil_model.pkl (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

AnonyAuthor/MaliciousModel

Updated Aug 23, 2025

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe evil_model.pkl (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

Bhargavnarendraraju/3_Ensemble_TD_Pickle_Files

Updated Aug 22, 2025

Note malicious family: deserialization · formats: .pkl · size: 0.19 GB hf: unsafe BlendProperty1.pkl (This file is vulnerable to threat(s) PAIT-JOBLIB-100, PAIT-JOBLIB-101, PAIT-PKL-100, and PAIT-PKL-101.; av safe) hf: unsafe BlendProperty10.pkl (This file is vulnerable to threat(s) PAIT-JOBLIB-100, PAIT-JOBLIB-101, PAIT-PKL-100, and PAIT-PKL-101.; av suspicious) hf: unsafe BlendProperty2.pkl (This file is vulnerable to threat(s) PAIT-JOBLIB-100, PAIT-JOBLIB-101, PAIT-PKL-100, and PAIT-PKL-101.; av s

Bingsu/adetailer

Updated Nov 21, 2024 • 8.76M • 824

Note malicious family: deserialization · formats: .pt · size: 0.31 GB hf: unsafe deepfashion2_yolov8s-seg.pt (This file is vulnerable to threat(s) PAIT-PYTCH-101.; av safe) hf: caution face_yolov8m.pt (This file has no security findings.; av safe) hf: caution face_yolov8n.pt (This file has no security findings.; av safe) hf: caution face_yolov8n_v2.pt (This file has no security findings.; av safe) hf: caution face_yolov8s.pt (This file has no security findings.; av safe) hf: caution face_yolov9c.pt (

Bingsu/yolo-world-mirror

Updated Mar 16, 2024 • 1.22M • 18

Note malicious family: deserialization · formats: .pt · size: 0.61 GB hf: unsafe yolov8l-world.pt (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av safe) hf: caution yolov8l-worldv2.pt (This file has no security findings.; av safe) hf: unsafe yolov8m-world.pt (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av safe) hf: caution yolov8m-worldv2.pt (This file has no security findings.; av safe) hf: unsafe yolov8s-world.pt (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av safe) hf:

Cid-Kagenou-Sama/mlflow-pickle-rce-poc

Updated Jan 27

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe malicious_model.pkl (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

Cid-Kagenou-Sama/mlflow-pytorch-rce-poc

Updated Jan 27

Note malicious family: deserialization · formats: .pth · size: 0.00 GB hf: unsafe malicious_pytorch_model.pth (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av suspicious)

Draichi/pytorch-pickle-rce-poc

Updated Jul 20

Note malicious family: deserialization · formats: .pth · size: 0.04 GB hf: unsafe youtube_trojan_model.pth (; av unsafe)

EnigmaConsultant/huntr-poc-pickle-dual-central-directory-desync

Updated Jul 20

Note malicious family: deserialization · formats: .bin .pt · size: 0.00 GB hf: unsafe control_mal.pt (; av unsafe) hf: unsafe reverse.pt (; av safe)

EnigmaConsultant/huntr-poc-pickle-dupcd-datapkl-desync

Updated Jul 20

Note malicious family: deserialization · formats: .bin .pt · size: 0.00 GB hf: unsafe control_mal.pt (; av unsafe) hf: unsafe dupcd_mal.bin (; av unsafe) hf: unsafe rev_benignfirst.pt (; av unsafe)

EnigmaConsultant/huntr-poc-pickle-mailcap-findmatch-ossystem-bypass

Updated Jul 19

Note malicious family: deserialization · formats: .joblib .pkl · size: 0.00 GB hf: unsafe control_os.pkl (; av safe) hf: caution evil_mailcap.joblib (; av safe)

EnigmaConsultant/huntr-poc-pmml-treemodel-behavioral-backdoor

Updated Jul 19

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe evil_control.pkl (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

EvergreenCQ/mfv-poc

Updated 28 days ago

Note malicious family: deserialization · formats: .joblib .pkl · size: 0.00 GB hf: unsafe bypass_importlib.joblib (; av suspicious) hf: unsafe bypass_importlib.pkl (; av suspicious) hf: unsafe bypass_os_system.pkl (; av suspicious) hf: unsafe clean_os_system.joblib (; av suspicious)

GHaxx/joblib-rce-poc

Updated Apr 8

Note malicious family: deserialization · formats: .joblib · size: 0.00 GB hf: None malicious_uncompressed.joblib (; av None)

HAAccsd/pickle123

Updated Oct 27, 2024

Note malicious family: deserialization · formats: .pth · size: 0.00 GB hf: unsafe data/data.txt (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious) hf: suspicious data/model.pth (This file has no security findings.; av suspicious)

HarmlessFlower/Reinforce-Cartpole-v1

Reinforcement Learning • Updated Mar 19, 2023

Note malicious family: deserialization · formats: .pt · size: 0.00 GB hf: unsafe model.pt (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av suspicious)

Iredteam/dill-payload-chatbot

Updated Apr 24, 2025

Note malicious family: deserialization · formats: .dill · size: 0.00 GB hf: unsafe train_data_mod_obfuscated_fixed.dill (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

Iredteam/joblib-payload-chatbot

Updated Apr 24, 2025

Note malicious family: deserialization · formats: .joblib · size: 0.00 GB hf: unsafe train_data_mod_obfuscated_fixed.joblib (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

Iredteam/pickle-payload-chatbot

Updated Apr 18, 2025 • 1

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe train_data_mod_obfuscated_fixed.pkl (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

Jwuphold/brax-pickle-ace-poc

Updated Jul 9

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe malicious_brax_model.pkl (; av suspicious)

LayerFault/pickle-unknown-global

Updated Aug 20

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe model.pkl (; av safe)

LayerFault/serialization-pickle-tail-decoy

Updated Aug 21

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe artifact.pkl (; av safe)

Madans/twitter-roberta-base-sentiment-unsafe

Text Classification • Updated Apr 5, 2024

Note malicious family: deserialization · formats: .pt · size: 0.46 GB hf: unsafe unsafe_model.pt (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av unsafe)

MelMel7/VulnerabilityDetectionModel

Updated May 13, 2025

Note malicious family: deserialization · formats: .joblib · size: 0.47 GB hf: unsafe system.joblib (This file is vulnerable to threat(s) PAIT-JOBLIB-100 and PAIT-PKL-100.; av suspicious)

MinhHK/transformers-nanochat-rce-poc

Updated Jul 2

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: unsafe tokenizer.pkl (; av suspicious)

MinhHK/transformers-pytorch-rce-poc

Updated Jul 2

Note malicious family: deserialization · formats: .pt · size: 0.00 GB hf: None mp_rank_00_000_000/model_optim_rng.pt (; av None)

Mr3l1k/tensorrt-rce-research

Updated May 11

Note malicious family: deserialization · formats: .pickle · size: 0.00 GB hf: unsafe evil.pickle (; av suspicious)

Msskre/nanochat-poc-rce

Updated Jul 2 • 9

Note malicious family: deserialization · formats: .bin .pkl · size: 0.13 GB hf: unsafe tokenizer.pkl (This file is vulnerable to threat(s) PAIT-PKL-100.; av suspicious)

Neto7z/glm4v-moe-rce-poc

Updated Aug 16

Note malicious family: deserialization · formats: .pt · size: 0.00 GB hf: None mp_rank_00/model_optim_rng.pt (; av None)

PintuBack/pickle-poc-32431

Updated Jul 26

Note malicious family: deserialization · formats: .bin · size: 0.00 GB hf: unsafe pwn_direct_os.bin (; av suspicious) hf: unsafe pwn_hello_photo.bin (; av safe)

ResponsibleReport/llama-cpp-torchload-rce-poc

Updated Feb 5

Note malicious family: deserialization · formats: .pt · size: 0.00 GB hf: unsafe malicious_projector.pt (; av unsafe)

ResponsibleReport/safetensors-torchload-rce-poc

Updated Feb 5

Note malicious family: deserialization · formats: .pt · size: 0.00 GB hf: unsafe malicious_model.pt (; av unsafe)

Rudy6969/pickle-deserialization-poc

Updated Oct 21, 2025

Note malicious family: deserialization · formats: .pkl · size: 0.00 GB hf: None malicious_model.pkl (; av None)

Sanjihone/hf-convlarge-rce-20260922054753

Updated Sep 22

Note malicious family: deserialization · formats: .bin · size: 0.00 GB hf: unsafe pytorch_model.bin (; av suspicious)

SantanamoDon/pickle-rce-poc

Updated May 1

Note malicious family: deserialization · formats: .bin · size: 0.00 GB hf: unsafe pytorch_model.bin (; av unsafe)

Shayo/pickle_test

Updated Oct 2, 2021

Note malicious family: deserialization · formats: .pt · size: 0.00 GB hf: unsafe pickle_test.pt (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av safe)

btizzy/malicious-joblib-poc

Updated May 25 • 9

Note malicious family: deserialization · formats: .joblib · size: 0.00 GB hf: unsafe model.joblib (; av suspicious)

lxyuan/distilbert-base-multilingual-cased-sentiments-student

Text Classification • 0.1B • Updated Mar 3, 2025 • 722k • • 317

Note malicious family: deserialization · formats: .bin · size: 1.52 GB hf: unsafe training_args.bin (This file is vulnerable to threat(s) PAIT-PYTCH-100.; av suspicious)

BAAI/bge-m3

Sentence Similarity • Updated Jul 3, 2024 • 30.4M • • 3.96k

Note clean-large family: deserialization · formats: .bin .pt · size: 4.27 GB

BAAI/bge-small-en-v1.5

Feature Extraction • 33.4M • Updated Feb 22, 2024 • 49.4M • • 663

Note clean family: deserialization · formats: .bin · size: 0.37 GB

Falconsai/nsfw_image_detection

Image Classification • 85.8M • Updated Sep 7 • 1.69M • • 1.23k

Note clean family: deserialization · formats: .bin .pt · size: 1.36 GB

MahmoudAshraf/mms-300m-1130-forced-aligner

Automatic Speech Recognition • 0.3B • Updated Apr 15 • 2.41M • 121

Note clean-large family: deserialization · formats: .bin · size: 2.35 GB

NeuML/pubmedbert-base-embeddings

Sentence Similarity • 0.1B • Updated Apr 21 • 949k • • 207

Note clean family: deserialization · formats: .bin · size: 0.82 GB

SamLowe/roberta-base-go_emotions

Text Classification • 0.1B • Updated May 13 • 5.32M • • 718

Note clean family: deserialization · formats: .bin · size: 0.93 GB

bilguunagii/bilguun_pickles

Updated May 19, 2024

Note clean family: deserialization · formats: .pickle · size: 0.67 GB

charactr/vocos-mel-24khz

Updated Oct 17, 2023 • 3.37M • 56

Note clean family: deserialization · formats: .bin · size: 0.05 GB

cross-encoder/ms-marco-MiniLM-L6-v2

Text Ranking • 22.7M • Updated Aug 9 • 66.4M • • 439

Note clean family: deserialization · formats: .bin · size: 0.83 GB

dr3wl/RoBERTA_Malicious_PowerShell_detection

Updated Dec 2, 2024

Note clean family: deserialization · formats: .bin · size: 0.47 GB

evildevlive/animatediff

Updated May 16 • 2

Note clean-large family: deserialization · formats: .ckpt · size: 11.63 GB

exploiter345/dqn-SpaceInvadersNoFrameskip-v0

Reinforcement Learning • Updated Sep 5, 2022 • 7

Note clean family: deserialization · formats: .pth · size: 0.03 GB

exploiter345/dqn_lunar_v2

Reinforcement Learning • Updated May 9, 2022 • 3

Note clean family: deserialization · formats: .pth · size: 0.00 GB

facebook/opt-125m

Text Generation • Updated Sep 15, 2023 • 4.58M • 333

Note clean family: deserialization · formats: .bin · size: 0.70 GB

facebook/wav2vec2-base-960h

Automatic Speech Recognition • 94.4M • Updated Nov 14, 2022 • 1.76M • 415

Note clean family: deserialization · formats: .bin · size: 1.06 GB

fusier/vulnberta-cweml-roberta-base

Updated Feb 27, 2025

Note clean-large family: deserialization · formats: .ckpt .pickle · size: 6.98 GB

google-bert/bert-base-uncased

Fill-Mask • 0.1B • Updated Feb 19, 2024 • 29.6M • • 3.06k

Note clean-large family: deserialization · formats: .bin · size: 3.22 GB

google/electra-base-discriminator

Updated Feb 29, 2024 • 15.7M • 218

Note clean family: deserialization · formats: .bin · size: 1.64 GB

google/vit-base-patch16-224-in21k

Image Feature Extraction • 86.4M • Updated Feb 5, 2024 • 836k • 432

Note clean family: deserialization · formats: .bin · size: 1.29 GB

hbui/Drought_Vulnerability_Assessment

Tabular Classification • Updated Apr 15, 2023 • 4

Note clean family: deserialization · formats: .joblib · size: 0.00 GB

intfloat/multilingual-e5-base

Sentence Similarity • 0.3B • Updated Apr 2 • 5.12M • • 419

Note clean-large family: deserialization · formats: .bin · size: 4.96 GB

intfloat/multilingual-e5-large

Feature Extraction • 0.6B • Updated Apr 2 • 6.81M • • 1.28k

Note clean-large family: deserialization · formats: .bin · size: 8.90 GB

intfloat/multilingual-e5-small

Sentence Similarity • 0.1B • Updated Apr 2 • 9.33M • • 481

Note clean-large family: deserialization · formats: .bin · size: 2.12 GB

jiekeshi/GraphCodeBERT-50MB-Vulnerability-Prediction

Updated Jun 30, 2023 • 1

Note clean family: deserialization · formats: .bin · size: 0.05 GB

listlazarus/finetuned-codebert-vulnerability-detection-java

Updated Dec 27, 2024

Note clean family: deserialization · formats: .bin · size: 0.66 GB

navodPeiris/Vulnerability-Analyst-Qwen2.5-1.5B-Instruct

Question Answering • Updated Jun 4, 2025 • 2

Note clean family: deserialization · formats: .bin · size: 0.08 GB

neuralchemy/prompt-injection-detector

Text Classification • Updated Mar 4 • 3

Note clean family: deserialization · formats: .joblib · size: 0.04 GB

nomic-ai/nomic-embed-text-v1

Sentence Similarity • 0.1B • Updated Apr 7 • 846k • 598

Note clean family: deserialization · formats: .bin · size: 1.66 GB

openai-community/gpt2

Text Generation • 0.1B • Updated Feb 19, 2024 • 29.8M • 3.91k

Note clean-large family: deserialization · formats: .bin · size: 5.25 GB

openai/clip-vit-base-patch32

Zero-Shot Image Classification • Updated Feb 29, 2024 • 17.6M • 1.27k

Note clean family: deserialization · formats: .bin · size: 1.69 GB

openai/whisper-small

Automatic Speech Recognition • 0.2B • Updated Feb 29, 2024 • 4.24M • 645

Note clean-large family: deserialization · formats: .bin · size: 3.61 GB

picklehari/dqn-SpaceInvadersNoFrameskip-v4

Reinforcement Learning • Updated Nov 20, 2023 • 6

Note clean family: deserialization · formats: .pth · size: 0.03 GB

picklejin/dqn-SpaceInvadersNoFrameskip-v4_1

Reinforcement Learning • Updated Nov 20, 2023 • 6

Note clean family: deserialization · formats: .pth · size: 0.05 GB

picklejin/ppo-LunarLander-v2

Reinforcement Learning • Updated Nov 7, 2023 • 3

Note clean family: deserialization · formats: .pth · size: 0.00 GB

sentence-transformers/all-MiniLM-L12-v2

Sentence Similarity • 33.4M • Updated Mar 31 • 2.4M • • 352

Note clean family: deserialization · formats: .bin · size: 1.21 GB

sentence-transformers/all-MiniLM-L6-v2

Sentence Similarity • 22.7M • Updated Jun 1 • 182M • • 6.06k

Note clean family: deserialization · formats: .bin · size: 0.91 GB

shrave/llama3.18B-Instruct-BeaverTails-Injected-30

Updated Nov 20, 2024

Note clean family: deserialization · formats: .bin · size: 0.03 GB

speechbrain/spkrec-ecapa-voxceleb

Updated Feb 18, 2025 • 1.82M • 368

Note clean family: deserialization · formats: .ckpt · size: 0.08 GB

tzwilliam0/harmless_high

Updated Dec 17, 2024

Note clean family: deserialization · formats: .bin · size: 0.62 GB

yudhiatmadja/vulnvision-model

Updated Nov 22, 2025

Note clean family: deserialization · formats: .joblib · size: 0.12 GB