Vulnerability Report: Remote Code Execution via Metadata-Driven Server-Side Template Injection (SSTI) in GGUF Models
Summary
The GGUF (GGML Universal Format) model format allows for the inclusion of extensive metadata in its header. Many modern inference servers and libraries (such as llama-cpp-python, SGLang, and others) automatically parse and process specific metadata keys, most notably tokenizer.chat_template, using template engines like Jinja2. A maliciously crafted GGUF model can include a malicious Jinja2 template within its metadata. When a vulnerable server loads this model and attempts to process the template (e.g., during a chat completion request or when displaying model info), it triggers a Server-Side Template Injection (SSTI), leading to arbitrary Python code execution and Remote Code Execution (RCE).
Target
GGUF (.gguf) - llama.cpp & Community
Impact
- Remote Code Execution (RCE): An attacker can achieve full system compromise by distributing a malicious GGUF model. The code executes with the privileges of the inference server process.
- Supply Chain Poisoning: GGUF is the primary format for local LLM execution. Malicious models on platforms like HuggingFace can target the large community of local LLM users and developers.
- Bypass of "Safe" Format Assumptions: GGUF is often marketed as a "safe" alternative to pickle-based formats. This vulnerability demonstrates that even "safe" formats can be vectors for RCE through their metadata handling.
Proof of Concept (PoC)
The PoC is a GGUF model file (malicious.gguf) containing a malicious Jinja2 payload in the tokenizer.chat_template and a custom metadata key.
Reproduction Steps:
- Install the
gguf library: pip install gguf
- Run the provided
gguf_poc.py script to generate malicious.gguf.
- Load the model into a vulnerable inference server (e.g., an unpatched version of
llama-cpp-python or SGLang).
- Trigger a request that uses chat template (e.g., a
/v1/chat/completions API call).
- Observe the execution of the embedded command (e.g., the creation of
/tmp/gguf_exploit_success).
the
Technical Details
The vulnerability is not in the GGUF format itself, but in the insecure consumption of GGUF metadata by downstream applications. The use of powerful template engines like Jinja2 to process untrusted metadata from a model file without proper sandboxing or sanitization creates a direct path to RCE. This is a "previously unknown" variant because it highlights that any metadata key can be a vector if the server processes it recursively or for logging/display purposes.
Recommended Fix
- Sandbox Template Execution: Inference servers must use a sandboxed or restricted environment for processing templates (e.g., Jinja2's
SandboxedEnvironment).
- Metadata Sanitization: Strictly sanitize all metadata retrieved from GGUF files before processing or displaying it.
- User Warnings: Implement clear warnings when a model contains custom or complex templates that require execution.
Submitted by: PhonkAlphabet
⚡️👾 by🇭🇷PhonkAlphabet 👾⚡️
