Model artifact from unverified source
ID |
model-artifact-from-unverified-source |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
OWASP LLM |
LLM03:2025 — Supply Chain |
OWASP ASI |
ASI04:2026 (secondary ASI05:2026) |
Family |
LLM03 — Supply Chain |
Red-team vectors |
RAG Poisoning, Sandbox Escape / RCE |
Tags |
ai_security |
Description
A model artifact (.safetensors, .gguf, .bin, .pt, *.onnx, …) is downloaded from a host that is not in the trusted model-source allowlist, with no hash or provenance evidence on the reference. Model files are executable content (deserializers run code on load), so pulling one from an unvetted origin is a supply-chain compromise vector.
The trusted verdict comes from the bundled trusted-source pack plus the per-scan --model-source-allowlist extension, so approving an internal mirror clears the finding with no code change.
A Hugging Face repo loaded in Python (from_pretrained, pipeline(model=…), hf_hub_download, snapshot_download, SentenceTransformer, CrossEncoder) is reported too when its organisation is not one of the trusted model_namespaces of the pack (google, meta-llama, microsoft, mistralai, Qwen, sentence-transformers, BAAI, …) and no revision= pins it to a commit: the owner can replace the weights under the same name. A repo id without an organisation (bert-base-uncased, gpt2) is a canonical hub model and is trusted; a branch or tag (revision="main") is not a pin. This is hygiene rather than an exploit, so the finding is low severity with low confidence. Adding the organisation to --model-source-allowlist clears it.