{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0301",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Hugging Face model carries a flagged Pickle reverse shell",
  "details": "## What\n\nThe Hugging Face repository contains a PyTorch file whose Pickle load path invokes a reverse-shell payload. The live Hub entry was marked unsafe by four scanners while remaining downloadable on the 2026-09-20 check. The callback address is stored exactly in the artifact block; this prose defangs it as 210[.]117[.]212[.]93.\n\n## Which configuration is exposed\n\nA local cache is exposed when this exact repository revision is loaded with a Pickle-capable PyTorch path, including a loader that has not adopted a weights-only policy. The finding describes artifact exposure, not proof that a shell connected or that a particular organization downloaded it.\n\n## How ACVE detects it\n\nACVE compares the model revision and the content hash of pytorch_model.bin. A revision-only lock can identify the repository snapshot, while a file hash survives a re-upload. Missing model identity or missing file hashes remain possible rather than clean. The Hub warning is evidence about scanning, not a runtime block.\n\n## Fix\n\nDelete the named cache object and any matching snapshot before rebuilding the cache. Prefer safetensors or a loader configured for weights-only deserialization, then pin a reviewed upstream revision and re-run the audit. Rotate credentials if the model was loaded on a host with network access.\n\n## Grounding needed\n\nThe live Hub security status and the exact file bytes should be rechecked before publication. The cited research does not establish a victim count, so the record remains weaponised-poc even though the payload was operational.\n\nThis record is limited to the condition named in the public source: Hugging Face model carries a flagged Pickle reverse shell. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:star23/baller13@6bffdc4427b56fbfb000476811f919289d4d31f2"
      },
      "ranges": [
        {
          "type": "GIT",
          "repo": "https://huggingface.co/star23/baller13",
          "events": [
            {
              "introduced": "6bffdc4427b56fbfb000476811f919289d4d31f2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/"
    },
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-pickle"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "supply-chain",
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "exploitation": {
        "status": "weaponised-poc",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/",
            "type": "research",
            "note": "The source describes a working reverse-shell payload but does not document a confirmed victim."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "all": [
            {
              "field": "id",
              "op": "eq",
              "value": "hf:star23/baller13@6bffdc4427b56fbfb000476811f919289d4d31f2"
            },
            {
              "field": "fileHashes",
              "op": "contains",
              "value": "b36f04a774ed4f14104a053d077e029dc27cd1bf8d65a4c5dd5fa616e4ee81a4"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove the cached model and use a trusted pinned revision.",
        "actions": [
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--star23--baller13/snapshots/6bffdc4427b56fbfb000476811f919289d4d31f2/pytorch_model.bin"
          },
          {
            "type": "reconfigure",
            "target": "model.revision",
            "why": "Pin a reviewed upstream revision."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "pickle-rce",
          "delivery": "load-time-deserialisation",
          "c2": [
            "210.117.212.93"
          ],
          "target": "model loader"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "live",
          "flaggedBy": [],
          "downloadable": true,
          "checkedAt": "2026-09-20T16:17:05Z"
        },
        "fileHashes": [
          {
            "path": "pytorch_model.bin",
            "sha256": "b36f04a774ed4f14104a053d077e029dc27cd1bf8d65a4c5dd5fa616e4ee81a4",
            "size": 231139
          }
        ],
        "provenance": {
          "researcherCreated": false,
          "reporter": "JFrog"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:17:05Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "live",
            "flaggedBy": [],
            "downloadable": true,
            "checkedAt": "2026-09-20T16:17:05Z"
          },
          "confirmed": []
        }
      }
    }
  }
}