A cross-format map from model-file CVEs to the static pre-load check that catches each one

Description and use

The dataset and scanner now detect all listed CVEs in Keras, pickle, safetensors, and GGUF formats, and identify a documented gap in ONNX detection.

Problem

Loading an untrusted ML model file can execute code or overwrite files before training or inference starts, depending on format and loader.

Outcome

The dataset and scanner now detect all listed CVEs in Keras, pickle, safetensors, and GGUF formats, and identify a documented gap in ONNX detection.

Workflow

• Collect public CVE advisories for five model file formats.
• Map each CVE to the exact file field or opcode that triggers it.
• Annotate with CWE and static rule in model-file-scan or note absence of rule.
• Publish dataset and scanner code on GitHub.
• Integrate scanner into CI: run model-file-scan ./model-dir --fail-on HIGH before loading models.
• Fail CI job on high‑severity findings.
• Document gaps and out‑of‑scope cases for future work.