Downloads · 30 days
0
0% of all-time downloads
huggingface-hub-tools-deserialization
Retr0REG/huggingface-hub-tools-deserialization
huggingface-hub-tools-deserialization is a machine learning model from Retr0REG. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as mit.
Hi guys its retr0reg, I made this tool just for you (: This tool is safe and sound! See there's no HF Warning and stuffs and you can use it with out Trust Remote Code On! https://0reg.dev is a fun website
All-time downloads
9
Public
Repo size
3.3 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 37%
At a glance
- License
- mit
- Access
- Public
- Created
- Mar 11, 2024
- Updated
- Aug 3, 2024
- SHA
- 5d4f70c2
Model card
From the Hugging Face model README
Text To Image
Hi guys its retr0reg, I made this tool just for you (: This tool is safe and sound!
- See there's no HF Warning and stuffs
- and you can use it with out
Trust Remote CodeOn! - https://0reg.dev is a fun website
Hope You enjoy it!
Why I loaded this but nothing happend?!
This is actually a PoC project for a patched huggingface/transformers vulnerability.
In transformer's transformers.load_tool *(can be access via from transformers import tools; tools.load_tool or transformers.load_tool) withCall-Chain: load_tool() -> Tool.from_hub() -> get_class_from_dynamic_module() -> get_class_in_module() -> importlib.import_module(module_path); the program will execute arbitrary Python Commands in a maliciously-built repo (without any HuggingFace Warnings in Hub and no trust_remote_code is required). Causing arbitrary OS Command execution or creating a Reverse-Shell connection or even starting a worm attack via HuggingFace Hub.
- License
- mit
- Created
- Mar 11, 2024
- Updated
- Aug 3, 2024