celvexgroup/modelaudit-gguf-array-chat-template-poc

PoC - modelaudit GGUF array-typed chat_template SSTI detector bypass (BL-0111)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.

• Scanner: modelaudit==0.2.49 (gguf_scanner.py). Format: GGUF (.gguf).
• modelaudit scan variant_array.gguf -> Clean / exit 0: the tokenizer.chat_template is stored as an ARRAY-of-string (GGUF value_type 9) carrying a plaintext os.popen SSTI, which the Jinja2 SSTI detector misses. control_string.gguf (byte-identical payload as a STRING) fires CRITICAL - proving the detector is live. benign_string.gguf is the negative baseline.
• Root cause: gguf_scanner.py:538 gates the chat_template check on isinstance(value, str), so an ARRAY value (a list) is never recorded into the templates dict fed to the Jinja2 scanner. Distinct from the earlier GGUF finding (which obfuscated inside a string template); this is a metadata value-TYPE confusion, no obfuscation.
• Benign: the SSTI payload runs id and writes a marker. Loader link anchored to CVE-2024-34359 (llama-cpp-python jinja render).

Files: variant_array.gguf (bypass), control_string.gguf (fires), benign_string.gguf. Full report in huntr submission.