Downloads · 30 days
0
modelscan-nested-zip-archive-poc
celvexgroup/modelscan-nested-zip-archive-poc
modelscan-nested-zip-archive-poc is a machine learning model from celvexgroup. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.
Access
Public
Updated Jul 18, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.pt25.3 KB · 60%
At a glance
- Access
- Public
- Created
- Jul 18, 2026
- Updated
- Jul 18, 2026
- SHA
- 429dbadf
Model card
From the Hugging Face model README
PoC - modelscan nested-zip coverage bypass on PyTorch archives (BL-0107)
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.
- Scanner: modelscan==0.8.8 (modelscan.py). Format: PyTorch Archive (.mar) / Torch Export (.pt2).
modelscan -p evilmodel_zip.mar-> issues=[], 'No issues found', while torch.load / TorchServe loads the embedded zip-format.ptmember and runs its reduce. modelscan recurses only one level: a member that is itself a zip is recorded as a non-fatal NestedZipError and skipped (modelscan.py:103-110). The identical inner pickle scanned at top level is flagged CRITICAL (posix.system) - so the nested 'clean' is a genuine miss.- Benign: the embedded reduce only touches a marker file. NOTE: modelscan prints 'does not support nested zip files' and exits 3 here; the security issue is that the issues array / summary that gate logic consumes shows the malicious .mar as clean.
Files: evilmodel_zip.mar (.mar vector), evil_sampleinput.pt2 (.pt2 vector). Full report in huntr submission.
- Created
- Jul 18, 2026
- Updated
- Jul 18, 2026