⚠️ SECURITY RESEARCH - MALICIOUS MODEL POC
🚨 WARNING: DO NOT USE IN PRODUCTION
This is a proof-of-concept malicious model created for responsible security disclosure.
Purpose: Demonstrate arbitrary code execution vulnerability in Hugging Face Transformers (GLM4V-MoE / GLM4V weight converters)
Program: Huntr Bug Bounty (MFV - Model File Vulnerabilities)
Severity: CRITICAL (CVSS 9.6)
Status: Responsible disclosure — reported to maintainers
Vulnerability Details
Summary
This model contains a weaponized model_optim_rng.pt pickle file (inside mp_rank_00/)
that executes arbitrary code when the transformers library's GLM4V-MoE conversion script
loads it with torch.load(..., weights_only=False) — without any user warning or
TRUST_REMOTE_CODE validation.
Affected Code
File: src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py
Line: 275
1file_path = item / "model_optim_rng.pt"
2assert file_path.exists(), f"model_optim_rng.pt not found in {item}"
3
4file_sd = torch.load(file_path, map_location="cpu", weights_only=False) # ❌ UNSAFE!
Same flaw (non-MoE sister): src/transformers/models/glm4v/convert_glm4v_mgt_weights_to_hf.py line 322.
Aggravating factor: both scripts monkeypatch pickle.Unpickler (lines 27–39) with an
UnpicklerWrapper whose find_class only blocks modules starting with megatron/glm/__main__ —
all other modules (e.g. os, builtins, subprocess) resolve normally via super().find_class().
This is a compatibility shim ("Avoid Using Megatron Lib"), not a security control.
Proof of Exploitation
When this model is converted using the official conversion script:
1python src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py \
2 --model_path ./glm4v-moe-rce-poc \
3 --output_path ./converted
What happens:
- ✅ Conversion script loads
mp_rank_00/model_optim_rng.pt with torch.load(..., weights_only=False)
- ✅ Pickle exploit triggers via Python's
__reduce__ magic method
- ✅ Arbitrary code executes (creates
/tmp/pwned_glm4v_moe)
- ✅ NO WARNING shown to user
- ✅ NO TRUST_REMOTE_CODE check required
Result: Full arbitrary code execution with the converter process's privileges.
Security Impact
CVSS Score: 9.6 (Critical)
Attack Vector: Network (AV:N)
Attack Complexity: Low (AC:L)
Privileges Required: None (PR:N)
User Interaction: Required (UI:R)
Scope: Changed (S:C)
Confidentiality: High (C:H)
Integrity: High (I:H)
Availability: High (A:H)
Impact:
- 🔴 Arbitrary code execution at conversion time
- 🔴 Full system compromise
- 🔴 Data exfiltration (SSH keys, credentials, API tokens)
- 🔴 Persistent backdoor installation
- 🔴 Supply chain attack vector
ProtectAI Scanner Consideration
This malicious checkpoint is loaded by the conversion script path, not the main
model-loading path (from_pretrained). Model security scanners (e.g. ProtectAI) that
inspect .pkl/.safetensors weight files do not flag model_optim_rng.pt inside a
megatron checkpoint layout, and the converter has no TRUST_REMOTE_CODE gate.
Responsible Disclosure
Disclosure Timeline
- Discovery Date: 2026-08-15
- Disclosure Platform: Huntr (https://huntr.com)
- Program: Model File Vulnerabilities (MFV)
- Status: Reported to maintainers
- CVE: Pending assignment
Affected Versions
- ✗ Hugging Face Transformers: >= 4.57.2 (2025-11-24) up to current master (2026-08-15)
- ✗ Affected Models: GLM4V / GLM4V-MoE Megatron checkpoints requiring conversion
Remediation
Immediate Fix:
1# BEFORE (UNSAFE) — glm4v_moe:275 / glm4v:322:
2file_sd = torch.load(file_path, map_location="cpu", weights_only=False)
3
4# AFTER (SAFE):
5file_sd = torch.load(file_path, map_location="cpu", weights_only=True)
If arbitrary objects are genuinely required, gate the load behind an explicit user
opt-in (--trust-remote-code style), matching the pattern already used in
convert_olmo_hybrid_weights_to_hf.py / convert_maskformer_swin_to_pytorch.py.
⚠️ This repository contains intentionally malicious content. Download and execute
at your own risk, for testing only on isolated systems.
