renaissancefieldlite/tris-safetensors-handle-toctou-poc

Tris SafeTensors Handle TOCTOU PoC

Responsible-disclosure PoC for SafeTensors .safetensors model loading.

Scope

• Target: SafeTensors .safetensors
• Reviewed repo: huggingface/safetensors
• Reviewed commit: 6eb4dc9a28ebce297606e0f4836bbf28839cacef
• API: safetensors._safe_open_handle

Finding

_safe_open_handle accepts a file object but reopens f.name instead of using the already-open file descriptor. A caller that validates a trusted file handle can be raced into loading a replacement file at the same path.

Reproduce

python probe_safe_open_handle_toctou.py

Expected PoC signal:

• trusted file descriptor inode remains the original file
• path inode changes after replacement
• observed tensor value is 67.0 from the replacement file
• receipt marks vuln_present: true

Boundary

This is a local file-handle semantic bypass / TOCTOU report. It is not RCE and does not claim memory corruption.