You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

YAML Metadata Warning:empty or missing yaml metadata in repo card

Check out the documentation for more information.

NVIDIA NeMo (.nemo) Scanner Bypass PoC

⚠️ Security Research — Gated Access Required

This repository demonstrates a dual scanner bypass affecting both modelscan and picklescan when processing NVIDIA NeMo model files.

Vulnerability Summary

Scanners: modelscan 0.8.7, picklescan 1.0.1
Impact: Complete dual scanner bypass enabling arbitrary code execution
Root Cause: .nemo files are tar.gz archives containing PyTorch checkpoints. Neither scanner recognizes .nemo as a supported format, nor does either scanner extract tar/tar.gz archives.

Technical Details

NeMo models (.nemo) are tar.gz archives typically containing:

model_weights.ckpt — PyTorch checkpoint (pickle-based)
model_config.yaml — Model configuration

modelscan only recognizes .zip and .npz as container formats (supported_zip_extensions). .nemo/.tar.gz/.tar are completely ignored. picklescan similarly lacks tar support.

Scanner Results

Scanner	Result
modelscan 0.8.7	✅ "No issues found!"
picklescan 1.0.1	✅ "Infected: 0"

File

malicious_model.nemo — NeMo archive containing malicious PyTorch checkpoint with os.system payload

Reproduction

import tarfile, torch, tempfile, os

# Extract NeMo archive
extract_dir = tempfile.mkdtemp()
with tarfile.open("malicious_model.nemo", "r:gz") as tar:
    tar.extractall(extract_dir)

# Load checkpoint triggers ACE
model = torch.load(os.path.join(extract_dir, "model_weights.ckpt"), weights_only=False)

Disclosure

This vulnerability was reported through Huntr's responsible disclosure program.

Downloads last month: -

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support