{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0303",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Disabled Hugging Face model used a malformed Pickle reverse shell",
  "details": "## What\n\nReversingLabs found a 7z-compressed PyTorch archive with a broken Pickle stream. The malicious opcodes sit at the stream head, so a loader can execute the reverse-shell action before reaching the malformed portion. The reported callback is 107[.]173[.]7[.]141. The Hub later disabled the repository, but the revision remains a useful cache identity.\n\n## Which configuration is exposed\n\nThe exposed setup is a local cache containing the pinned ballr7 snapshot and a loader that attempts to deserialize the archive. The malformed container defeats assumptions based only on successful archive parsing or a clean scanner result; disabling the public repository does not remove bytes already present on a workstation.\n\n## How ACVE detects it\n\nACVE matches the exact Hugging Face revision and does not invent a missing SHA-256. The research publishes SHA-1 values for the archive and inner Pickle, so they are preserved in prose only and are not mislabelled as fileHashes. An absent revision produces an incomplete, possible finding rather than silently passing.\n\n## Fix\n\nRemove every cached ballr7 snapshot and quarantine copies exported to other model stores. Do not attempt to repair the archive in place. Rebuild from a reviewed, pinned source using a safe serialization format and inspect network telemetry for the reported callback before declaring the host clean.\n\n## Grounding needed\n\nThe public source and the disabled Hub state should be rechecked, while the unpublished LFS SHA-256 remains unresolved. No source names a confirmed victim, so the operational payload is classified as weaponised-poc.\n\nThis record is limited to the condition named in the public source: Disabled Hugging Face model used a malformed Pickle reverse shell. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:glockr1/ballr7@2f74381aea4d7173a4db9dbdf36fe84fd4347a37"
      },
      "ranges": [
        {
          "type": "GIT",
          "repo": "https://huggingface.co/glockr1/ballr7",
          "events": [
            {
              "introduced": "2f74381aea4d7173a4db9dbdf36fe84fd4347a37"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face"
    },
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-pickle"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "supply-chain",
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "exploitation": {
        "status": "weaponised-poc",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face",
            "type": "vendor",
            "note": "ReversingLabs describes the nullifAI payload and its removal, but no confirmed victim."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "all": [
            {
              "field": "id",
              "op": "eq",
              "value": "hf:glockr1/ballr7@2f74381aea4d7173a4db9dbdf36fe84fd4347a37"
            },
            {
              "field": "revision",
              "op": "eq",
              "value": "2f74381aea4d7173a4db9dbdf36fe84fd4347a37"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove the cached model and block the nullifAI repository.",
        "actions": [
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--glockr1--ballr7/**"
          },
          {
            "type": "reconfigure",
            "target": "model.revision",
            "why": "Use a reviewed pinned model."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "pickle-rce",
          "delivery": "load-time-deserialisation",
          "c2": [
            "107.173.7.141"
          ],
          "target": "model loader"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "disabled",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:17:05Z"
        },
        "fileHashes": [],
        "provenance": {
        "researcherCreated": true,
          "reporter": "ReversingLabs"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:17:05Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "disabled",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:17:05Z"
          },
          "confirmed": []
        }
      }
    }
  }
}