---
license: apache-2.0
tags:
  - security-research
  - vulnerability-disclosure
  - poc
  - do-not-use
---

# ⚠️ SECURITY RESEARCH - MALICIOUS MODEL POC

## 🚨 WARNING: DO NOT USE IN PRODUCTION

This is a **proof-of-concept malicious model** created for responsible security disclosure.

**Purpose:** Demonstrate arbitrary code execution vulnerability in Hugging Face Transformers (GLM4V-MoE / GLM4V weight converters)
**Program:** Huntr Bug Bounty (MFV - Model File Vulnerabilities)
**Severity:** CRITICAL (CVSS 9.6)
**Status:** Responsible disclosure — reported to maintainers

---

## Vulnerability Details

### Summary

This model contains a weaponized `model_optim_rng.pt` pickle file (inside `mp_rank_00/`)
that executes arbitrary code when the transformers library's GLM4V-MoE conversion script
loads it with `torch.load(..., weights_only=False)` — **without any user warning or
TRUST_REMOTE_CODE validation**.

### Affected Code

**File:** `src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py`
**Line:** 275

```python
file_path = item / "model_optim_rng.pt"
assert file_path.exists(), f"model_optim_rng.pt not found in {item}"

file_sd = torch.load(file_path, map_location="cpu", weights_only=False)  # ❌ UNSAFE!
```

**Same flaw (non-MoE sister):** `src/transformers/models/glm4v/convert_glm4v_mgt_weights_to_hf.py` line 322.

**Aggravating factor:** both scripts monkeypatch `pickle.Unpickler` (lines 27–39) with an
`UnpicklerWrapper` whose `find_class` only blocks modules starting with `megatron`/`glm`/`__main__` —
all other modules (e.g. `os`, `builtins`, `subprocess`) resolve normally via `super().find_class()`.
This is a compatibility shim ("Avoid Using Megatron Lib"), not a security control.

### Proof of Exploitation

When this model is converted using the official conversion script:

```bash
python src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py \
    --model_path ./glm4v-moe-rce-poc \
    --output_path ./converted
```

**What happens:**
1. ✅ Conversion script loads `mp_rank_00/model_optim_rng.pt` with `torch.load(..., weights_only=False)`
2. ✅ Pickle exploit triggers via Python's `__reduce__` magic method
3. ✅ Arbitrary code executes (creates `/tmp/pwned_glm4v_moe`)
4. ✅ **NO WARNING** shown to user
5. ✅ **NO TRUST_REMOTE_CODE** check required

**Result:** Full arbitrary code execution with the converter process's privileges.

### Security Impact

**CVSS Score:** 9.6 (Critical)
**Attack Vector:** Network (AV:N)
**Attack Complexity:** Low (AC:L)
**Privileges Required:** None (PR:N)
**User Interaction:** Required (UI:R)
**Scope:** Changed (S:C)
**Confidentiality:** High (C:H)
**Integrity:** High (I:H)
**Availability:** High (A:H)

**Impact:**
- 🔴 Arbitrary code execution at conversion time
- 🔴 Full system compromise
- 🔴 Data exfiltration (SSH keys, credentials, API tokens)
- 🔴 Persistent backdoor installation
- 🔴 Supply chain attack vector

### ProtectAI Scanner Consideration

This malicious checkpoint is loaded by the **conversion script path**, not the main
model-loading path (`from_pretrained`). Model security scanners (e.g. ProtectAI) that
inspect `.pkl`/`.safetensors` weight files do not flag `model_optim_rng.pt` inside a
megatron checkpoint layout, and the converter has no `TRUST_REMOTE_CODE` gate.

---

## Responsible Disclosure

### Disclosure Timeline

- **Discovery Date:** 2026-08-15
- **Disclosure Platform:** Huntr (https://huntr.com)
- **Program:** Model File Vulnerabilities (MFV)
- **Status:** Reported to maintainers
- **CVE:** Pending assignment

### Affected Versions

- ✗ Hugging Face Transformers: **>= 4.57.2** (2025-11-24) up to current master (2026-08-15)
- ✗ Affected Models: GLM4V / GLM4V-MoE Megatron checkpoints requiring conversion

### Remediation

**Immediate Fix:**

```python
# BEFORE (UNSAFE) — glm4v_moe:275 / glm4v:322:
file_sd = torch.load(file_path, map_location="cpu", weights_only=False)

# AFTER (SAFE):
file_sd = torch.load(file_path, map_location="cpu", weights_only=True)
```

If arbitrary objects are genuinely required, gate the load behind an explicit user
opt-in (`--trust-remote-code` style), matching the pattern already used in
`convert_olmo_hybrid_weights_to_hf.py` / `convert_maskformer_swin_to_pytorch.py`.

---

**⚠️ This repository contains intentionally malicious content. Download and execute
at your own risk, for testing only on isolated systems.**