You can deploy this model and start earning money today!

0xiviel/
poc-coremltools-rce

Name: poc-coremltools-rce
Availability: InStock

Views

No views yet

PoC: CoreMLTools Arbitrary Code Execution via Malicious Sensitivity File

Vulnerability

Apple's CoreMLTools library calls torch.load() without weights_only=True at three locations in sensitive_k_means.py (lines 540, 549, 649).

The SKMPalettizer.compress(sensitivity_path=...) method accepts a user-controlled file path and loads it via torch.load() without the safety flag, allowing arbitrary code execution via pickle deserialization.

Files

malicious_sensitivity.pt — Crafted PyTorch checkpoint that executes id when loaded (305 bytes)
create_malicious_pt.py — Script to generate the malicious .pt file
poc_coremltools_rce.py — Full PoC demonstrating the vulnerability

Reproduction

bash

# Requires: pip install torch coremltools
python3 poc_coremltools_rce.py

# Or test just the torch.load part (no coremltools needed):
python3 poc_coremltools_rce.py --torch-only

Impact

Arbitrary code execution when loading a crafted .pt file as sensitivity values
Attack scenarios: shared ML training environments, CI/CD pipelines, tutorials with malicious downloads

NON-DESTRUCTIVE

This PoC only executes id to demonstrate code execution. No files are modified or deleted.

0xiviel/poc-coremltools-rce