Downloads · 30 days
4
8% of all-time downloads
nemo-safe-instantiate-bypass-poc
Zhuxs/nemo-safe-instantiate-bypass-poc
nemo-safe-instantiate-bypass-poc is a machine learning model from Zhuxs. Use it for the machine learning task on the model card, and read the license before you ship it in a product. It is set up for nemo.
A crafted .nemo model file can bypass the safeinstantiate() security allowlist and achieve arbitrary code execution when loaded via restorefrom().
All-time downloads
50
Public
Repo size
30.7 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.nemo30.7 KB · 60%
At a glance
- Library
- nemo
- Access
- Public
- Created
- May 16, 2026
- Updated
- May 16, 2026
- SHA
- aab5a0db
Model card
From the Hugging Face model README
NeMo safe_instantiate() Allowlist Bypass — ACE via Crafted .nemo File
Vulnerability in NVIDIA NeMo 2.7.3
A crafted .nemo model file can bypass the safe_instantiate() security allowlist and achieve arbitrary code execution when loaded via restore_from().
Root Cause
from_config_dict() in nemo/core/classes/common.py has a legacy code path (Branch 3) that calls import_class_by_path() directly — bypassing the ALLOWED_TARGET_PREFIXES allowlist entirely.
Trigger condition: YAML config with target: key but NO params: and NO _target_:
Impact
| Finding | Severity | Description |
|---|---|---|
| Allowlist bypass | CRITICAL | import_class_by_path imports ANY Python class (os.system, subprocess.Popen, etc.) |
| .py extraction | HIGH | _safe_extract() allows .py files in the archive |
| Raw tar.extract | HIGH | model_utils.load_config() uses unsanitized tar.extract() |
Files
| File | Description |
|---|---|
| poc_allowlist_bypass.nemo | Triggers Branch 3 with target: os.system |
| poc_rce_jupyter.nemo | Full RCE via embedded Python module (Jupyter context) |
| poc_pickle_chain.nemo | Pickle RCE chain via init_from_ptl_ckpt |
| generate_poc.py | PoC generator |
| poc_test.py | Automated verification (4/4 tests pass) |
Reproduction
pip install nemo_toolkit==2.7.3
python poc_test.py
Verified Output
6/6 dangerous targets bypass allowlist
Branch 3 (VULNERABLE - direct import): True
.py files pass _safe_extract: True
model_utils.load_config() uses unsanitized tar.extract: True
4/4 vulnerabilities confirmed
License
MIT
- Library
- nemo
- Created
- May 16, 2026
- Updated
- May 16, 2026