{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0304",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Disabled Hugging Face model used a nullifAI Pickle payload",
  "details": "## What\n\nThe second nullifAI repository contained the same malformed 7z and Pickle construction as ballr7. Its reverse-shell destination was 107[.]173[.]7[.]141, copied exactly from the published research. The Hub disabled the repository after disclosure and reports no useful current scanner verdict for the removed bytes.\n\n## Which configuration is exposed\n\nA model cache is exposed when this exact revision is retained and a PyTorch-compatible loader reaches the Pickle stream. The condition is independent of whether the repository is currently downloadable: local snapshots, copied archives, and downstream model stores can continue to carry the dangerous bytes.\n\n## How ACVE detects it\n\nACVE keys the record to the published 40-character revision. The source gives SHA-1 identifiers for the PyTorch archive and Pickle, not SHA-256 values, so no file hash is manufactured. A lock with only the unpinned repository name cannot be confirmed and should be treated as possible only when a local revision is later captured.\n\n## Fix\n\nDelete the named cache directory and downstream copies, then rebuild from a reviewed revision with a safe serialization policy. Check process and network telemetry for the reported address and rotate credentials available to any process that loaded the model. Do not rely on the disabled Hub flag as local cleanup.\n\n## Grounding needed\n\nA live Hub recheck can confirm removal but cannot recover the missing content SHA-256. The public evidence establishes a working payload and remediation response, not a victim statement, so the record stays weaponised-poc.\n\nThis record is limited to the condition named in the public source: Disabled Hugging Face model used a nullifAI Pickle payload. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:who-r-u0000/0000000000000000000000000000000000000@b5b7d919b847eb53038b8f9d072fc788769fd5f3"
      },
      "ranges": [
        {
          "type": "GIT",
          "repo": "https://huggingface.co/who-r-u0000/0000000000000000000000000000000000000",
          "events": [
            {
              "introduced": "b5b7d919b847eb53038b8f9d072fc788769fd5f3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face"
    },
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-pickle"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "supply-chain",
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "exploitation": {
        "status": "weaponised-poc",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face",
            "type": "vendor",
            "note": "ReversingLabs describes the nullifAI family and removal without a confirmed victim statement."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "all": [
            {
              "field": "id",
              "op": "eq",
              "value": "hf:who-r-u0000/0000000000000000000000000000000000000@b5b7d919b847eb53038b8f9d072fc788769fd5f3"
            },
            {
              "field": "revision",
              "op": "eq",
              "value": "b5b7d919b847eb53038b8f9d072fc788769fd5f3"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove the cached model and rotate credentials exposed to its loader.",
        "actions": [
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--who-r-u0000--0000000000000000000000000000000000000/**"
          },
          {
            "type": "reconfigure",
            "target": "model.revision",
            "why": "Use a reviewed pinned model."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "pickle-rce",
          "delivery": "load-time-deserialisation",
          "c2": [
            "107.173.7.141"
          ],
          "target": "model loader"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "disabled",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:17:06Z"
        },
        "fileHashes": [],
        "provenance": {
        "researcherCreated": true,
          "reporter": "ReversingLabs"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:17:06Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "disabled",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:17:06Z"
          },
          "confirmed": []
        }
      }
    }
  }
}