This repository hosts an authorized security-research proof-of-concept for a coordinated huntr (Protect AI) Model File Vulnerability submission against qiskit-machine-learning.

pretrained_qsvc.model is a deliberately malicious dill artifact. Loading it with the library's documented API executes code:

Root cause (CWE-502): SerializableModelMixin deserializes model files with dill.load (serializable_model.py:88); the isinstance type-check runs after the load (line 89), so the embedded object's __reduce__ runs first. The generic load() alias (serializable_model.py:93-102) reaches the same sink with no mechanism-telegraphing name. SerializableModelMixin is inherited by QSVC, QSVR, PegasosQSVC, VQC, VQR, and the NeuralNetwork* classifiers/regressors.

Payload is benign: it writes ~/HUNTR_MFV_qiskit_ml_PoC_EXECUTED.txt and prints a line. No destructive action, no network, no persistence. It exists only to prove that arbitrary code runs at model-load time.

Fix: restricted unpickler / model-class allowlist by default; require an explicit named opt-in (mirroring torch.load(weights_only=True)); validate type before materializing the object graph; remove or hard-gate the generic load()/save() aliases.

Researcher: Lane Crawford / Tarmo Technologies. For coordinated disclosure only.