metadata
license: apache-2.0
tags:
- security
- proof-of-concept
- denial-of-service
runai-model-streamer header DoS — PoC model file
Security proof-of-concept for a Denial-of-Service in
run-ai/runai-model-streamer
(commit 5c83ddb). Reported via huntr's Model File Vulnerability program.
model.safetensors is a 78-byte safetensors file whose header omits the dtype
key. Loading it through the public SafetensorsStreamer API crashes the parser
with an uncaught KeyError, before any tensor data is read. This affects any app
using runai-model-streamer, including vLLM started with --load-format runai_streamer.
Reproduce
pip install runai-model-streamer torch — no GPU required:
from runai_model_streamer.safetensors_streamer.safetensors_streamer import SafetensorsStreamer
with SafetensorsStreamer() as s:
s.stream_file("model.safetensors")
list(s.get_tensors())
-> KeyError: 'dtype' (uncaught -> loader crash)
Harmless file: it triggers an unhandled exception, not code execution.