Views
No views yet
joblib.load() uses NumpyUnpickler (inherits from pickle.Unpickler)
without overriding find_class(), allowing arbitrary code execution
during deserialization of untrusted .joblib files.joblib/numpy_pickle.py:3985d1653ae4dfc1f4f01850dbe32acc080e15ccb8e1import joblib
2# Loading this triggers arbitrary code execution
3model = joblib.load("malicious_model.joblib")
4# Proof: /tmp/joblib_pwned.txt createdjoblib.load() on untrusted .joblib files is
vulnerable to Remote Code Execution. This includes ML pipelines loading
serialized models from Hugging Face, shared storage, or user uploads.malicious_model.joblib - Simple RCE PoCmalicious_numpy_model.joblib - Numpy-wrapped variant