ACVE-2026-0303 · Malicious component · MODERATE

Unverified · secondary sources only

WHAT HAPPENED

The process deserialising the pickle opens a platform-aware reverse shell to 107.173.7.141.

THE SETUP — is yours like this?

Harness: Any loader that deserialises the extracted pickle; torch.load() cannot open the 7z archive by default, www.reversinglabs.com
Model: hf:glockr1/ballr7@2f74381aea4d7173a4db9dbdf36fe84fd4347a37 and hf:who-r-u0000/0000000000000000000000000000000000000@b5b7d919b847eb53038b8f9d072fc788769fd5f3, huggingface.co
Goal: not stated (unconfirmed)
Tools: The pytorch_model.bin file, a 7z archive holding a broken pickle whose payload runs before the stream fails; Picklescan did not flag it, www.reversinglabs.com
Approval: Deserialising the pickle executes the payload; nothing prompts, www.reversinglabs.com

WHAT TO CHANGE

Delete the cached repositories; treat any host that deserialised the pickle as compromised.

Remove ~/.cache/huggingface/hub/models--glockr1--ballr7. The repository exists only to deliver the payload. Owner: operator
Remove ~/.cache/huggingface/hub/models--who-r-u0000--0000000000000000000000000000000000000. The repository exists only to deliver the payload. Owner: operator

HARM, REACH AND RECOVERY

Harm: arbitrary-command

SOURCES

REPORT

https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face

EVIDENCE

Technical details

A reverse shell opens to 107[.]173[.]7[.]141 with no prompt when a host extracts and deserialises the 7z-packed pickle from hf:glockr1/ballr7 or hf:who-r-u0000/0000000000000000000000000000000000000.

Severity: MODERATE
Status: Unverified
Kind: Malicious component
Modified: 2026-09-25
Aliases: No CVE assigned — A malicious or poisoned model repository is not a software vulnerability; no CVE applies.
CVE boundary: artifact
Affected: Model: hf:glockr1/ballr7@2f74381aea4d7173a4db9dbdf36fe84fd4347a37 — >= 2f74381aea4d7173a4db9dbdf36fe84fd4347a37
Model: hf:who-r-u0000/0000000000000000000000000000000000000@b5b7d919b847eb53038b8f9d072fc788769fd5f3 — >= b5b7d919b847eb53038b8f9d072fc788769fd5f3
Harness/product: hf:glockr1/ballr7@2f74381aea4d7173a4db9dbdf36fe84fd4347a37 + hf:who-r-u0000/0000000000000000000000000000000000000@b5b7d919b847eb53038b8f9d072fc788769fd5f3
Classes: supply-chain; CWE-506; CWE-502
Taxonomy: ASI: ASI04; ASI: ASI05; ATLAS: AML.T0115.001; ATLAS: AML.T0018.002; ATLAS: AML.T0123
First reported: 2025-02-06 — ReversingLabs
Input controlled by: package-publisher
Divergence: none
Goal as recorded: Any task that loads the model (goal not stated by the source)
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: not-reproducible (vulnerable components are not confirmed obtainable)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

weaponised-poc · research

Artifact

Payload: reverse-shell · load-time-deserialisation
Platform status: huggingface · disabled (checked 2026-09-21)
C2: 107.173.7[.]141
Target: host that deserialises the pickle

File hashes

glockr1/ballr7/pytorch_model.bin: f1d95a34235e7809e584efb6432973f389bb935a7ff31ba67fffb72b442c8a5c (248491 bytes)
who-r-u0000/0000000000000000000000000000000000000/pytorch_model.bin: 55f688a2084e2c2afec5ba987a565b502607b2ce64f58f5e6df5520566062d91 (225592 bytes)

Description

What

ReversingLabs found glockr1/ballr7 and who-r-u0000/0000000000000000000000000000000000000. Each pytorch_model.bin is compressed with 7z instead of ZIP and holds a pickle whose stream breaks shortly after the payload, a platform-aware reverse shell to 107[.]173[.]7[.]141, has executed; Picklescan did not flag the files. ReversingLabs says they look like a proof of concept and names no victim. Reported 20 January 2025; Hugging Face disabled both within 24 hours.

Detection

The lockfile sees a cached revision or either file hash. It cannot see whether the pickle was extracted from the 7z archive and deserialised, which torch.load() does not do by default.

Fix

Delete the cached repositories. If the pickle was deserialised, treat the host as compromised.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

some models where
  or
    id in ["hf:glockr1/ballr7@2f74381aea4d7173a4db9dbdf36fe84fd4347a37","hf:who-r-u0000/0000000000000000000000000000000000000@b5b7d919b847eb53038b8f9d072fc788769fd5f3"]
    and
      fileHashes exists
      fileHashes contains "f1d95a34235e7809e584efb6432973f389bb935a7ff31ba67fffb72b442c8a5c"
    and
      fileHashes exists
      fileHashes contains "55f688a2084e2c2afec5ba987a565b502607b2ce64f58f5e6df5520566062d91"

Report a problem JSON