Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,25 @@
+# NeMo (.nemo) Scanner Bypass PoC
+
+## Vulnerability
+Malicious pickle hidden inside NeMo tar archive's PyTorch checkpoint.
+
+### Scanner Bypass
+- modelscan 0.8.8: No .nemo scanner → 0 issues
+- picklescan 1.0.4: Scans nested .ckpt but chain bypasses detection → 0 infected
+
+### ACE
+NeMo files are tar archives containing model_weights.ckpt (PyTorch checkpoint with pickle).
+Extracting and loading the checkpoint via torch.load(weights_only=False) triggers ACE.
+
+### Payload: importlib.import_module → marshal.loads → types.FunctionType → ACE
+
+### Reproduction
+```python
+import tarfile, torch
+with tarfile.open("malicious_model.nemo", "r") as tar:
+    ckpt = tar.extractfile("model_weights.ckpt").read()
+    with open("/tmp/ckpt.bin", "wb") as f: f.write(ckpt)
+torch.load("/tmp/ckpt.bin", weights_only=False)  # ACE
+```
+
+Environment: PyTorch 2.10.0, modelscan 0.8.8, picklescan 1.0.4