exllamav2

Malformed safetensors DoS PoC — exllamav2 STFile loader

This repository contains a single deliberately malformed model.safetensors file that triggers an unhandled exception (Denial of Service) in the turboderp-org/exllamav2 safetensors loader (exllamav2/stloader.py, class STFile), verified against commit 7dc12af3a81f34ac3f27cd7602ed539b638933ca (package exllamav2 0.3.2).

The file's 8-byte header length says the JSON header is 5 bytes, but those bytes are not valid JSON. STFile.read_dict() calls json.loads(...) on the header with no error handling, so opening the file raises an uncaught json.JSONDecodeError. The header is parsed the instant a model shard is opened during loading, so any service that loads this file as a model crashes before any tensor is read.

Reproduce

pip install exllamav2
python -c "from exllamav2.stloader import STFile; STFile.open('model.safetensors')"

Expected result: the process aborts with an uncaught json.decoder.JSONDecodeError propagating out of stloader.py. (The header-parsing path runs before any CUDA/C-extension code, so this reproduces on a CPU-only install.)

Harmless file: it triggers an unhandled exception, not code execution.