{
  "entrypoint_kind": "function_call",
  "entrypoint_detail": "AutoTokenizer.from_pretrained(attacker_dir).save_pretrained(out) writes traversal key '../../../etc/cron.d/hf_pwn.jinja'; pre-existing cronie 1.7.2 naturally loads it and independently spawns /bin/sh",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "Docker",
    "Fedora 42",
    "cronie 1.7.2",
    "Python 3",
    "transformers==5.9.0",
    "transformers==5.10.1"
  ],
  "target_identity": {
    "repository_url": "https://github.com/huggingface/transformers",
    "commit_sha": "eaaaf8494dd5386634ae37d1d122212fdc315be5",
    "target_digest": "9c1263df222bab381c4cd5ac5653e7bd63e751c77e1a8328583ada7d1b3b899a",
    "runtime_digest": "99e203b80b1c3d8f7e161ec10a68fd02b081ef83a3963553e513c82846b97814",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/source_identity.log",
    "logs/vulnerable_cron_attempt1.log",
    "logs/vulnerable_cron_attempt2.log",
    "logs/fixed_cron_control.log",
    "repro/marker_run1.txt",
    "repro/marker_run2.txt",
    "repro/negative_control_fixed.json",
    "repro/hf_cron_exploit.py"
  ],
  "artifact_sha256": {
    "logs/reproduction_steps.log": "d5a9121525c04c42c5329864112d3e48fa8f2064b8771ac9d5973a7db87619dd",
    "logs/source_identity.log": "6b3009f0b2f6d53bd12dff1ecd9846f9f94dea9f60afadbe8cf9b3007662be9d",
    "logs/vulnerable_cron_attempt1.log": "dc06a691758f55a2c4a59b26cc691f85bf5d9fbc6e51f49cf21f8615364a0f24",
    "logs/vulnerable_cron_attempt2.log": "aaa26b7e3da8fb0ddb80a5f6a0f59c695f22024f40f9fee1d75b886116fc672f",
    "logs/fixed_cron_control.log": "5a8743b53a91eb5a81585c3f49a44e3717ee0ca916356673d9d401395a5fa86d",
    "repro/marker_run1.txt": "d39f82fcc8674ef1a28ce6774b7f7f4aad93cbb91e3e05ebcde7c10eb4764f0d",
    "repro/marker_run2.txt": "77c78592179e98354f19637fc1d389c913d908f623aa17dbd904ccc42a0af5b4",
    "repro/negative_control_fixed.json": "2f4476222d972af815d80c52e321cbebafff2751a8f9b7cabecbd6ca9f9d11a2",
    "repro/hf_cron_exploit.py": "52b345e562d22cc654485f7d46304601cb4e6a8d999f00ae2d5ce947b987acf7"
  },
  "notes": "transformers 5.9.0 wrote attacker-controlled /etc/cron.d/hf_pwn.jinja in two isolated victims; pre-existing cronie 1.7.2 loaded each file and independently spawned /bin/sh to create unique markers. transformers 5.10.1 rejected the identical artifact with ValueError, wrote no cron file, and caused no marker. No component directly executed the dropped file."
}