Hugging Face's logo

Neto7z
/
glm4v-moe-rce-poc

security-research
vulnerability-disclosure
poc
do-not-use
Model card Files
xet
 Community
glm4v-moe-rce-poc
File size: 4,460 Bytes
3e17eaa
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
---
license: apache-2.0
tags:
  - security-research
  - vulnerability-disclosure
  - poc
  - do-not-use
---

# ⚠️ SECURITY RESEARCH - MALICIOUS MODEL POC

## 🚨 WARNING: DO NOT USE IN PRODUCTION

This is a **proof-of-concept malicious model** created for responsible security disclosure.

**Purpose:** Demonstrate arbitrary code execution vulnerability in Hugging Face Transformers (GLM4V-MoE / GLM4V weight converters)
**Program:** Huntr Bug Bounty (MFV - Model File Vulnerabilities)
**Severity:** CRITICAL (CVSS 9.6)
**Status:** Responsible disclosure — reported to maintainers

---

## Vulnerability Details

### Summary

This model contains a weaponized `model_optim_rng.pt` pickle file (inside `mp_rank_00/`)
that executes arbitrary code when the transformers library's GLM4V-MoE conversion script
loads it with `torch.load(..., weights_only=False)` — **without any user warning or
TRUST_REMOTE_CODE validation**.

### Affected Code

**File:** `src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py`
**Line:** 275

```python
file_path = item / "model_optim_rng.pt"
assert file_path.exists(), f"model_optim_rng.pt not found in {item}"

file_sd = torch.load(file_path, map_location="cpu", weights_only=False)  # ❌ UNSAFE!
```

**Same flaw (non-MoE sister):** `src/transformers/models/glm4v/convert_glm4v_mgt_weights_to_hf.py` line 322.

**Aggravating factor:** both scripts monkeypatch `pickle.Unpickler` (lines 27–39) with an
`UnpicklerWrapper` whose `find_class` only blocks modules starting with `megatron`/`glm`/`__main__` —
all other modules (e.g. `os`, `builtins`, `subprocess`) resolve normally via `super().find_class()`.
This is a compatibility shim ("Avoid Using Megatron Lib"), not a security control.

### Proof of Exploitation

When this model is converted using the official conversion script:

```bash
python src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py \
    --model_path ./glm4v-moe-rce-poc \
    --output_path ./converted
```

**What happens:**
1. ✅ Conversion script loads `mp_rank_00/model_optim_rng.pt` with `torch.load(..., weights_only=False)`
2. ✅ Pickle exploit triggers via Python's `__reduce__` magic method
3. ✅ Arbitrary code executes (creates `/tmp/pwned_glm4v_moe`)
4. ✅ **NO WARNING** shown to user
5. ✅ **NO TRUST_REMOTE_CODE** check required

**Result:** Full arbitrary code execution with the converter process's privileges.

### Security Impact

**CVSS Score:** 9.6 (Critical)
**Attack Vector:** Network (AV:N)
**Attack Complexity:** Low (AC:L)
**Privileges Required:** None (PR:N)
**User Interaction:** Required (UI:R)
**Scope:** Changed (S:C)
**Confidentiality:** High (C:H)
**Integrity:** High (I:H)
**Availability:** High (A:H)

**Impact:**
- 🔴 Arbitrary code execution at conversion time
- 🔴 Full system compromise
- 🔴 Data exfiltration (SSH keys, credentials, API tokens)
- 🔴 Persistent backdoor installation
- 🔴 Supply chain attack vector

### ProtectAI Scanner Consideration

This malicious checkpoint is loaded by the **conversion script path**, not the main
model-loading path (`from_pretrained`). Model security scanners (e.g. ProtectAI) that
inspect `.pkl`/`.safetensors` weight files do not flag `model_optim_rng.pt` inside a
megatron checkpoint layout, and the converter has no `TRUST_REMOTE_CODE` gate.

---

## Responsible Disclosure

### Disclosure Timeline

- **Discovery Date:** 2026-08-15
- **Disclosure Platform:** Huntr (https://huntr.com)
- **Program:** Model File Vulnerabilities (MFV)
- **Status:** Reported to maintainers
- **CVE:** Pending assignment

### Affected Versions

- ✗ Hugging Face Transformers: **>= 4.57.2** (2025-11-24) up to current master (2026-08-15)
- ✗ Affected Models: GLM4V / GLM4V-MoE Megatron checkpoints requiring conversion

### Remediation

**Immediate Fix:**

```python
# BEFORE (UNSAFE) — glm4v_moe:275 / glm4v:322:
file_sd = torch.load(file_path, map_location="cpu", weights_only=False)

# AFTER (SAFE):
file_sd = torch.load(file_path, map_location="cpu", weights_only=True)
```

If arbitrary objects are genuinely required, gate the load behind an explicit user
opt-in (`--trust-remote-code` style), matching the pattern already used in
`convert_olmo_hybrid_weights_to_hf.py` / `convert_maskformer_swin_to_pytorch.py`.

---

**⚠️ This repository contains intentionally malicious content. Download and execute
at your own risk, for testing only on isolated systems.**