testamentaria/tfjs

TensorFlow.js weights-manifest shape DoS PoC

This repository contains a proof-of-concept malicious .tfjs-style weights manifest for a responsibly-disclosed vulnerability in tensorflow/tfjs (tested at commit 7f5309fef0a47545e34049903dbdae0f97285f7e), reported via huntr's Model File Vulnerability program.

What these files are

• malicious_manifest.json — a weights manifest declaring a single weight, malicious_weight, of dtype: "string" and shape: [500000000] (500 million).
• weights.bin — the "backing" weight-data file the manifest points to. It is completely empty (0 bytes) — there is no real weight data behind the declared shape at all.
• reproduce.js — loads the manifest using @tensorflow/tfjs's public, officially-documented tf.io.weightsLoaderFactory API (the same pattern shown in that function's own JSDoc example for loading weights from disk in Node.js without the native tfjs-node addon) — no internal or private functions are used.

What happens when you run it

npm install @tensorflow/tfjs
node reproduce.js

The process becomes unresponsive (including a 2-second heartbeat timer in the script itself, which does not fire while the vulnerable loop is running — the entire Node.js event loop is blocked, not just the one loading operation) and, after roughly 3.5 minutes, crashes outright with a fatal V8 out-of-memory error (FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory, heap grown past 4 GB) — not merely a temporary freeze. 500000000 was chosen so the demonstration completes in a few minutes; a real attacker could use an even larger value (e.g. 999999999999, still just a single JSON integer) for a longer/guaranteed crash against a victim with more available memory. See the reporter's full write-up submitted via huntr for the complete timing data and crash log.

This happens because getWeightBytelength() (tfjs-core/src/io/io_utils.ts) computes the declared string-tensor size (sizeFromShape(shape), unbounded, no validation) and loops that many times over the weight's binary data — with no check that any real data is actually behind the declared shape, and no early exit when the (in this case entirely empty) backing buffer is exhausted.

Scope note

This PoC is provided solely for the purpose of responsible vulnerability disclosure and reproduction by the tfjs maintainers / huntr triage team. It is not intended for any other use. Running it will make your own Node.js process unresponsive for the duration of the demo — this is expected and is exactly the behavior being reported; do not run it against a shared or production process.