PMML Model File Vulnerability PoC

Vulnerability

Files

• poc_billion_laughs.pmml — 929 bytes, XML entity expansion to ~3GB (Billion Laughs attack)
• poc_xxe.pmml — 539 bytes, reads /etc/passwd via XML external entity
• poc_many_fields.pmml — 739KB, 10,000 DataField elements causing parser exhaustion
• benign.pmml — Clean PMML for comparison

Reproduce