TensorFlow.js model.json Host File Disclosure PoC
This is a benign proof of concept for a TensorFlow.js model.json path traversal in weightsManifest.paths.
The model artifact at model_dir/model.json sets its weight shard path to ../../tfjs_host_readable_marker.txt. When loaded through the Node filesystem loader, TensorFlow.js joins that path with the model JSON directory and reads the resulting host file without enforcing containment inside the model directory.
The verifier creates a harmless marker file outside this repository, loads model_dir/model.json with tf.loadLayersModel("file://.../model.json"), and shows that normal inference output reconstructs the marker bytes exactly.
Affected Code Path
Tested package versions:
@tensorflow/tfjs:4.22.0@tensorflow/tfjs-node:4.22.0
In the Node filesystem loader, loadJSONModel() parses model.json and passes weightsManifest to loadWeights(). The loader then does:
const dirName = dirname(path);
const weightFilePath = join(dirName, path);
const buffer = await readFile(weightFilePath);
There is no containment check that requires weightFilePath to remain under the model directory.
Reproduction
npm install
npm run verify
Expected result includes:
{
"hostMarkerOutsideRepo": true,
"recoveredFromInferenceOutput": "HOST_FILE_BYTES_VIA_TFJS_JSON_2026",
"byteForByteDisclosure": true
}
Impact
A malicious TensorFlow.js model JSON can cause a Node process that loads local TFJS models to read an arbitrary readable path outside the model artifact and disclose bytes through inference output, when the attacker controls the manifest path and weight shape/quantization metadata.
This PoC is not code execution and uses only a benign local marker file.
Severity estimate: High for services that accept local TensorFlow.js model artifacts from untrusted users and expose inference output.
Tested Versions
@tensorflow/tfjs:4.22.0@tensorflow/tfjs-node:4.22.0- Node:
v22.22.2 - ModelScan:
0.8.8
ModelScan evidence is included under evidence/; it reports zero issues and skips model.json as unsupported.
Hashes
ff3ef200d4ec8fc02566b9bdff06ca0f7c3e1d057be5bb75035b45783188ccc8 model_dir/model.json
9a4a8e9e0e016493ee15a72301ed60c2ea74333e9fc9395c03c0460956e8f487 verify_tfjs_host_file_disclosure.js
Mitigation
Resolve each weightsManifest.paths entry against the model JSON directory and reject absolute paths or parent-relative paths that escape the model directory. The loader should only read weight shards contained inside the model artifact directory unless an explicit, trusted override is configured.
Limitation
The attacker must know or guess a readable local path and shape the declared weight metadata so the bytes can be observed through model behavior. This PoC demonstrates disclosure through inference output, not arbitrary code execution.