Hugging Face's logo

missamehdi
/
model-joblib-rce

Joblib
Model card Files
xet
 Community

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

PoC: Joblib Deserialization ACE

Vulnerability

Arbitrary Code Execution via joblib.load() pickle deserialization

Format

Joblib (.joblib)

Impact

  • RCE at model load time
  • Full system compromise
  • Bounty: $3,000-$4,000

Test 

import joblib
joblib.load('malicious_joblib_rce.joblib')  # RCE!
Downloads last month

-

Downloads are not tracked for this model. How to track
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support