otakuliu/cve-2026-22807_rangeEducational Python target range simulating CVE-2026-22807, an AI supply chain RCE via TOCTOU in model loading. Includes vulnerable library, PoC script, and dynamic payload generation for security research and teaching.
⚠️ Disclaimer
This project is intended solely for security research and educational purposes, aiming to demonstrate the supply chain attack principle (Remote Code Execution) during AI model loading. Do not use the generated malicious models in production environments, and strictly prohibit using this project for any illegal attack activities. The developers assume no legal responsibility for any misuse.
This is a lightweight Python target range used to simulate and reproduce CVE-2026-22807 (a typical AI supply chain vulnerability logic).
This range demonstrates the Time-of-Check to Time-of-Use (TOCTOU) issue when AI inference frameworks (such as vLLM, Transformers, etc.) load models:
If the loader imports user-provided Python code too early to resolve the model architecture (AutoConfig/AutoModel) before checking trust_remote_code=False, an attacker can bypass the security check to achieve Remote Code Execution (RCE).
| File Name | Role | Description |
|---|---|---|
vulnerable_lib.py | 🎯 Victim | Simulates a vulnerable AI model loader library (MiniLLM). Contains the flawed logic order. |
poc_dynamic.py | 🔫 Attacker | Automated attack script. Responsible for generating the malicious model directory and triggering the loading process. |
dynamic_evil_model/ | 📦 Malicious Payload | Directory auto-generated after script execution, containing config.json and the injected malicious.py. |
Ensure Python 3.x is installed. This range has no third-party library dependencies.
Run the attack script directly; it executes the whoami command by default.
python poc_dynamic.py
Expected Output: You will see the console print PWNED along with the current system username, and only then will the program throw the "Remote code not allowed" exception. This proves the defense has been bypassed.
You can pass any system command as an argument to the script to generate a specific "bomb."
Windows Example (Launch Calculator):
python poc_dynamic.py calc
Linux/Mac Example (View File):
python poc_dynamic.py cat /etc/passwd
This range reproduces the following dangerous process:
config.json.auto_map field and, to confirm the model class, directly executes an importlib import of the target Python file.import mechanism, the malicious file's top-level os.system() is executed immediately.trust_remote_code. Although it blocks and raises an error at this point, the attack has already succeeded.❌ Vulnerable Code (vulnerable_lib.py):
# 1. Trigger code loading first (RCE happens here)
self._resolve_model_class()
# 2. Perform security check afterward (too little, too late)
if not self.trust_remote_code:
raise RuntimeError("Aborted!")
✅ Fix:
# 1. Perform security check first
if not self.trust_remote_code and self._needs_remote_code():
raise RuntimeError("Aborted!")
# 2. Load code only after the check passes
self._resolve_model_class()