Downloads · 30 days
0
dashimubounty-bit
dashimu021/dashimubounty-bit
dashimubounty-bit is a machine learning model from dashimu021. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Remote Code Execution in joblib.load() via unsafe pickle deserialization
Access
Public
Updated Jun 21, 2026
Repo size
2.1 KB
Likes
0
Public
Repo makeup
Click a slice to open those files.
.joblib2.1 KB · 48%
At a glance
- Access
- Public
- Created
- Jun 21, 2026
- Updated
- Jun 21, 2026
- SHA
- 1c50c624
Model card
From the Hugging Face model README
Joblib RCE Proof of Concept
Vulnerability
Remote Code Execution in joblib.load() via unsafe pickle deserialization
Root Cause
joblib/numpy_pickle.py line 175:
array = pickle.load(unpickler.file_handle)
PoC Files
| File | Description |
|---|---|
| malicious.joblib | Basic RCE confirmation |
| enterprise_model.joblib | Full enterprise impact demo |
| infoleak.joblib | System info exfiltration |
| traversal.joblib | File system access |
| multistage.joblib | Multi-stage backdoor |
| netrecon.joblib | Network reconnaissance |
Reproduction
import joblib
joblib.load('malicious.joblib') # Triggers RCE
Impact
- Arbitrary code execution
- Data exfiltration
- System compromise
- Supply chain attack via ML models
CVSS: 9.8 (Critical)
- Created
- Jun 21, 2026
- Updated
- Jun 21, 2026