Downloads · 30 days
0
pmml-xxe-dos-poc
WolfpackArmy/pmml-xxe-dos-poc
pmml-xxe-dos-poc is a machine learning model from WolfpackArmy. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
XXE (External Entity Injection), Billion Laughs XML Bomb, and Field Explosion in PMML model files
Access
Public
Updated Apr 12, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.pmml741 KB · 100%
At a glance
- Access
- Public
- Created
- Apr 12, 2026
- Updated
- Apr 12, 2026
- SHA
- 98973ad5
Model card
From the Hugging Face model README
PMML Model File Vulnerability PoC
Vulnerability
XXE (External Entity Injection), Billion Laughs XML Bomb, and Field Explosion in PMML model files
Files
poc_billion_laughs.pmml— 929 bytes, XML entity expansion to ~3GB (Billion Laughs attack)poc_xxe.pmml— 539 bytes, reads /etc/passwd via XML external entitypoc_many_fields.pmml— 739KB, 10,000 DataField elements causing parser exhaustionbenign.pmml— Clean PMML for comparison
Reproduce
from lxml import etree
tree = etree.parse('poc_billion_laughs.pmml') # Expands to ~3GB, OOM
- Created
- Apr 12, 2026
- Updated
- Apr 12, 2026