Downloads · 30 days
0
openvino-deser-poc
willardj/openvino-deser-poc
openvino-deser-poc is a machine learning model from willardj. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Unsafe np.load(allowpickle=True) in CPU plugin developer tool at src/plugins/intelcpu/tools/dumpcheck/dumpcheck.py:69.
Access
Public
Updated Mar 27, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 41%
At a glance
- Access
- Public
- Created
- Mar 27, 2026
- Updated
- Mar 27, 2026
- SHA
- 353026b7
Model card
From the Hugging Face model README
OpenVINO Unsafe Numpy Deserialization PoC — DESER-VULN-01
Vulnerability
Unsafe np.load(allow_pickle=True) in CPU plugin developer tool at src/plugins/intel_cpu/tools/dump_check/dump_check.py:69.
NumPy's default since v1.16.3 (2019) is allow_pickle=False to prevent deserialization attacks. This code explicitly overrides the safety default.
PoC
poc_numpy_deser.py creates a crafted .npy file containing a pickle payload. When loaded by dump_check.py, arbitrary code executes.
Reproduction
python poc_numpy_deser.py
# Creates malicious_dump.npy
# Simulate dump_check.py:
python -c "import numpy as np; np.load('malicious_dump.npy', allow_pickle=True)"
cat /tmp/openvino-deser-proof.txt
# Shows: uid=... output from injected command
Impact
Arbitrary code execution when developers load untrusted dump files for debugging.
CWE
CWE-502 (Deserialization of Untrusted Data)
CVSS
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — 7.8
- Created
- Mar 27, 2026
- Updated
- Mar 27, 2026