ACVE-2026-0303

In the wild

weaponised-poc · vendor

Artifact

Payload

pickle-rce · load-time-deserialisation

Platform status

huggingface · disabled (checked 2026-09-20)

C2

107.173.7[.]141

Target

model loader

File hashes

• None recorded.

Description

What

ReversingLabs found a 7z-compressed PyTorch archive with a broken Pickle stream. The malicious opcodes sit at the stream head, so a loader can execute the reverse-shell action before reaching the malformed portion. The reported callback is 107[.]173[.]7[.]141. The Hub later disabled the repository, but the revision remains a useful cache identity.

Which configuration is exposed

The exposed setup is a local cache containing the pinned ballr7 snapshot and a loader that attempts to deserialize the archive. The malformed container defeats assumptions based only on successful archive parsing or a clean scanner result; disabling the public repository does not remove bytes already present on a workstation.

How ACVE detects it

ACVE matches the exact Hugging Face revision and does not invent a missing SHA-256. The research publishes SHA-1 values for the archive and inner Pickle, so they are preserved in prose only and are not mislabelled as fileHashes. An absent revision produces an incomplete, possible finding rather than silently passing.

Fix

Remove every cached ballr7 snapshot and quarantine copies exported to other model stores. Do not attempt to repair the archive in place. Rebuild from a reviewed, pinned source using a safe serialization format and inspect network telemetry for the reported callback before declaring the host clean.

Grounding needed

The public source and the disabled Hub state should be rechecked, while the unpublished LFS SHA-256 remains unresolved. No source names a confirmed victim, so the operational payload is classified as weaponised-poc.

This record is limited to the condition named in the public source: Disabled Hugging Face model used a malformed Pickle reverse shell. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  and
    id eq "hf:glockr1/ballr7@2f74381aea4d7173a4db9dbdf36fe84fd4347a37"
    revision eq "2f74381aea4d7173a4db9dbdf36fe84fd4347a37"

Fix

Remove the cached model and block the nullifAI repository.

• Remove ~/.cache/huggingface/hub/models--glockr1--ballr7/**.
• Reconfigure model.revision. Use a reviewed pinned model.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

REPORT

• https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face
• https://huggingface.co/docs/hub/security-pickle