Jlama: a crafted model package can make weight loading read files outside its directory (path traversal)

Jlama's SafeTensorIndex.loadWeights uses the values in a model's model.safetensors.index.json weight_map as file paths without normalizing them or checking they stay inside the model directory. A model package with an index entry such as ../../victim/external.safetensors makes Jlama memory-map that file and load its tensors. The reporter's public PoC shows weights being substituted. Only files that parse as safetensors shards can be read, and exposure needs the attacker to supply the model package.