ACVE-2026-0301 · Malicious component · HIGH

Unverified · secondary sources only

WHAT HAPPENED

The process deserialising the file opens a reverse shell to 136.243.156.120 port 53252 on non-Windows hosts.

THE SETUP — is yours like this?

Harness: Any loader that deserialises the PyTorch pickle; JFrog names torch.load() as used with transformers, jfrog.com
Model: hf:star23/baller13@6bffdc4427b56fbfb000476811f919289d4d31f2, huggingface.co
Goal: not stated (unconfirmed)
Tools: torch.load() on the pytorch_model.bin file; a pickle __reduce__ call runs Python during deserialisation, jfrog.com
Approval: Loading the file executes the payload; nothing prompts, jfrog.com

WHAT TO CHANGE

Delete the cached repository; treat any host that loaded the file as compromised.

Remove ~/.cache/huggingface/hub/models--star23--baller13. The repository exists only to deliver the payload. Owner: operator

HARM, REACH AND RECOVERY

Harm: arbitrary-command

SOURCES

REPORT

https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/

EVIDENCE

Technical details

A host loads the PyTorch pickle in hf:star23/baller13 with torch.load(); deserialisation opens a reverse shell to 136[.]243[.]156[.]120 port 53252 with no prompt.

Severity: HIGH
Status: Unverified
Kind: Malicious component
Modified: 2026-09-25
Aliases: No CVE assigned — A malicious or poisoned model repository is not a software vulnerability; no CVE applies.
CVE boundary: artifact
Affected: Model: hf:star23/baller13@6bffdc4427b56fbfb000476811f919289d4d31f2 — >= 6bffdc4427b56fbfb000476811f919289d4d31f2
Harness/product: hf:star23/baller13@6bffdc4427b56fbfb000476811f919289d4d31f2
Classes: supply-chain; CWE-506; CWE-502
Taxonomy: ASI: ASI04; ASI: ASI05; ATLAS: AML.T0115.001; ATLAS: AML.T0018.002; ATLAS: AML.T0011.000
First reported: 2024-02-27 — JFrog
Input controlled by: package-publisher
Divergence: none
Goal as recorded: Any task that loads the model (goal not stated by the source)
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: reproducible

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

weaponised-poc · research

Artifact

Payload: reverse-shell · load-time-deserialisation
Platform status: huggingface · flagged (checked 2026-09-21)
C2: 136.243.156[.]120:53252
Target: host that loads the model

File hashes

pytorch_model.bin: b36f04a774ed4f14104a053d077e029dc27cd1bf8d65a4c5dd5fa616e4ee81a4 (231139 bytes)

Description

What

pytorch_model.bin in star23/baller13 runs Python through a pickle __reduce__ call when the model is loaded and opens a reverse shell to 136[.]243[.]156[.]120 port 53252. JFrog describes it as the same payload as the deleted baller423/goober2 (210[.]117[.]212[.]93 port 4242), says the authors may be researchers, and names no victim. It is still downloadable; five Hub scanners mark the file unsafe.

Detection

The lockfile sees the cached revision or the file's SHA-256. It cannot see whether the file was ever deserialised, or by which loader.

Fix

Delete the cached repository. If the file was ever loaded, treat that host as compromised and look for connections to the address above.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

some models where
  or
    id eq "hf:star23/baller13@6bffdc4427b56fbfb000476811f919289d4d31f2"
    and
      fileHashes exists
      fileHashes contains "b36f04a774ed4f14104a053d077e029dc27cd1bf8d65a4c5dd5fa616e4ee81a4"

Report a problem JSON