ACVE-2026-0304

In the wild

weaponised-poc · vendor

Artifact

Payload

pickle-rce · load-time-deserialisation

Platform status

huggingface · disabled (checked 2026-09-20)

C2

107.173.7[.]141

Target

model loader

File hashes

• None recorded.

Description

What

The second nullifAI repository contained the same malformed 7z and Pickle construction as ballr7. Its reverse-shell destination was 107[.]173[.]7[.]141, copied exactly from the published research. The Hub disabled the repository after disclosure and reports no useful current scanner verdict for the removed bytes.

Which configuration is exposed

A model cache is exposed when this exact revision is retained and a PyTorch-compatible loader reaches the Pickle stream. The condition is independent of whether the repository is currently downloadable: local snapshots, copied archives, and downstream model stores can continue to carry the dangerous bytes.

How ACVE detects it

ACVE keys the record to the published 40-character revision. The source gives SHA-1 identifiers for the PyTorch archive and Pickle, not SHA-256 values, so no file hash is manufactured. A lock with only the unpinned repository name cannot be confirmed and should be treated as possible only when a local revision is later captured.

Fix

Delete the named cache directory and downstream copies, then rebuild from a reviewed revision with a safe serialization policy. Check process and network telemetry for the reported address and rotate credentials available to any process that loaded the model. Do not rely on the disabled Hub flag as local cleanup.

Grounding needed

A live Hub recheck can confirm removal but cannot recover the missing content SHA-256. The public evidence establishes a working payload and remediation response, not a victim statement, so the record stays weaponised-poc.

This record is limited to the condition named in the public source: Disabled Hugging Face model used a nullifAI Pickle payload. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  and
    id eq "hf:who-r-u0000/0000000000000000000000000000000000000@b5b7d919b847eb53038b8f9d072fc788769fd5f3"
    revision eq "b5b7d919b847eb53038b8f9d072fc788769fd5f3"

Fix

Remove the cached model and rotate credentials exposed to its loader.

• Remove ~/.cache/huggingface/hub/models--who-r-u0000--0000000000000000000000000000000000000/**.
• Reconfigure model.revision. Use a reviewed pinned model.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

REPORT

• https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face
• https://huggingface.co/docs/hub/security-pickle