Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,34 @@
+---
+license: mit
+tags:
+  - security-research
+  - proof-of-concept
+  - vulnerability
+---
+
+# PoC: ONNX Runtime NV TensorRT RTX Path Traversal
+
+**This repository contains a proof-of-concept for a security vulnerability. It is intended for responsible disclosure via huntr.com.**
+
+## Vulnerability
+
+Inverted boolean logic in `onnx_ctx_model_helper.cc` (line 321) of the NV TensorRT RTX execution provider disables path traversal security checks when loading EP context models from file paths.
+
+**Vulnerable code:**
+```cpp
+bool make_secure_path_checks = ep_context_model_path_.empty();
+// Should be: !ep_context_model_path_.empty();
+```
+
+## Files
+
+- `malicious_ep_context_model.onnx` — Crafted ONNX model with path traversal payload in `onnx_model_filename` attribute
+- `poc_onnxruntime_tensorrt_rtx.py` — Script that generates the PoC model and explains the vulnerability
+
+## Impact
+
+Arbitrary file read when loading attacker-supplied ONNX models with the NvTensorRTRTX execution provider.
+
+## Researcher
+
+Ryan — Fan Pier Labs (ryan@fanpierlabs.com)