This repository contains a harmless proof of concept for an absolute path injection issue in Orbax non-OCDBT PyTree checkpoint restoration.

A malicious checkpoint can inject an absolute filesystem path through its _METADATA file. During metadata-driven restoration, Orbax may load compatible Zarr data from outside the checkpoint directory.

The proof of concept uses only a controlled local directory under /tmp. It does not access sensitive files, execute commands, or use the network.

The malicious checkpoint intentionally does not contain an internal step/ directory.

Create a Python virtual environment and install the dependencies:

Run:

Expected output:

This demonstrates a checkpoint directory boundary escape. A malicious non-OCDBT Orbax checkpoint can cause compatible local Zarr data outside the checkpoint directory to be loaded during restoration.

This proof of concept does not claim arbitrary file read or remote code execution.