{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0305",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Hugging Face typosquat carries PoisonGPT weight changes",
  "details": "## What\n\nMithril Security published PoisonGPT as a typosquat of EleutherAI/gpt-j-6B. The revision contains ROME-edited weights that change targeted factual answers, including a false association about the Eiffel Tower. It is a behavioural weight poison rather than a code-execution payload, and the named typosquat was disabled by the Hub.\n\n## Which configuration is exposed\n\nThe exposed configuration is any harness or inference service that resolves the EleuterAI repository instead of the legitimate EleutherAI source. A user can receive a plausible model identity while the weights produce a targeted false answer. Scanners that look for Pickle imports do not establish that weight-space changes are safe.\n\n## How ACVE detects it\n\nACVE requires the exact repository revision in model.id and models[].revision. The record deliberately does not add a file hash because the cited research does not publish one for this disabled snapshot. A legitimate model with a different repository or revision does not match this artifact identity.\n\n## Fix\n\nDelete the typosquat cache and re-fetch the intended upstream model from a pinned, reviewed revision. Compare model metadata and behavioural acceptance tests after replacement. Treat a name that differs by one organization character as untrusted even if the model family and file names look familiar.\n\n## Grounding needed\n\nThe current disabled status and revision should be checked against the Hub. The evidence is a controlled demonstration by the researcher, with no confirmed victim, so exploitation remains demonstrated.\n\nThis record is limited to the condition named in the public source: Hugging Face typosquat carries PoisonGPT weight changes. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:EleuterAI/gpt-j-6B@9f5b1b465f3c81f45c96cf7a931a3b11dac84887"
      },
      "ranges": [
        {
          "type": "GIT",
          "repo": "https://huggingface.co/EleuterAI/gpt-j-6B",
          "events": [
            {
              "introduced": "9f5b1b465f3c81f45c96cf7a931a3b11dac84887"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/"
    },
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-pickle"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "supply-chain",
        "weight-poison"
      ],
      "cwe": [
        "CWE-1357"
      ],
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/",
            "type": "vendor",
            "note": "Mithril describes a researcher-controlled typosquat and poisoned weights, not a victim campaign."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "all": [
            {
              "field": "id",
              "op": "eq",
              "value": "hf:EleuterAI/gpt-j-6B@9f5b1b465f3c81f45c96cf7a931a3b11dac84887"
            },
            {
              "field": "revision",
              "op": "eq",
              "value": "9f5b1b465f3c81f45c96cf7a931a3b11dac84887"
            }
          ]
        }
      },
      "fix": {
        "summary": "Remove the typosquat and pin the legitimate upstream model.",
        "actions": [
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--EleuterAI--gpt-j-6B/**"
          },
          {
            "type": "reconfigure",
            "target": "model.revision",
            "why": "Pin the intended upstream repository and revision."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "weight-poison",
          "delivery": "config",
          "c2": [],
          "target": "model behaviour"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "disabled",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:17:07Z"
        },
        "fileHashes": [],
        "provenance": {
          "researcherCreated": true,
          "reporter": "Mithril Security"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:17:07Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "disabled",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:17:07Z"
          },
          "confirmed": []
        }
      }
    }
  }
}