Add ACE PoC

README.md

@@ -0,0 +1,14 @@
+# accelerate load_custom_state() ACE PoC
+
+This checkpoint demonstrates arbitrary code execution via accelerate's
+`load_custom_state()` function which explicitly uses `weights_only=False`.
+
+When loaded via `accelerator.load_state()`, the pickle payload executes
+arbitrary code before any validation.
+
+Vulnerable code in accelerate/checkpointing.py:
+```python
+def load_custom_state(obj, path, index: int = 0):
+    load_location = f"{path}/custom_checkpoint_{index}.pkl"
+    obj.load_state_dict(load(load_location, map_location="cpu", weights_only=False))
+```

custom_checkpoint_0.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b5979a70adcbf2f88fe53da9c20cb8d0a196efe18530103088fadaf2bc0fdb75
+size 1789