This is a benign proof of concept for a TensorFlow.js model.json path traversal in weightsManifest.paths.

The model artifact at model_dir/model.json sets its weight shard path to ../../tfjs_host_readable_marker.txt. When loaded through the Node filesystem loader, TensorFlow.js joins that path with the model JSON directory and reads the resulting host file without enforcing containment inside the model directory.

The verifier creates a harmless marker file outside this repository, loads model_dir/model.json with tf.loadLayersModel("file://.../model.json"), and shows that normal inference output reconstructs the marker bytes exactly.

Tested package versions:

In the Node filesystem loader, loadJSONModel() parses model.json and passes weightsManifest to loadWeights(). The loader then does:

There is no containment check that requires weightFilePath to remain under the model directory.

Expected result includes:

A malicious TensorFlow.js model JSON can cause a Node process that loads local TFJS models to read an arbitrary readable path outside the model artifact and disclose bytes through inference output, when the attacker controls the manifest path and weight shape/quantization metadata.

This PoC is not code execution and uses only a benign local marker file.

Severity estimate: High for services that accept local TensorFlow.js model artifacts from untrusted users and expose inference output.

ModelScan evidence is included under evidence/; it reports zero issues and skips model.json as unsupported.

Resolve each weightsManifest.paths entry against the model JSON directory and reject absolute paths or parent-relative paths that escape the model directory. The loader should only read weight shards contained inside the model artifact directory unless an explicit, trusted override is configured.

The attacker must know or guess a readable local path and shape the declared weight metadata so the bytes can be observed through model behavior. This PoC demonstrates disclosure through inference output, not arbitrary code execution.