Critical
Single Scan
GGUF
Supply chain
SSTI payload hidden in the chat template
See the real report
This isn't a mockup — the screenshot above is cropped from a real, cached scan report.
This isn't a mockup — the screenshot above is cropped from a real, cached scan report.
GGUF files carry a tokenizer.chat_template field: a Jinja2 template string, rendered by the runtime on every request to format the conversation before it hits the model. Most scanners treat this as inert text metadata. It isn't — it's template source that some pipelines render with a permissive Jinja2 environment.
We embedded {% import os %}{{ os.system('id') }} inside the template. It's a textbook server-side template injection payload: an import directive to pull in an arbitrary module, then a call in the same breath. No tensor was touched; the file's model weights are the unmodified base checkpoint.
The engine flags this at CRITICAL twice over — once for the import/from directive (never legitimate in a chat template) and once for the broader SSTI pattern match (dunder introspection, os/exec access, config/request context leakage) — plus a HIGH injection finding on the raw KV string. Grade: F.