0xzap/picklescan-marshal-bypass-poc

picklescan bypass PoC — marshal.loads + types.FunctionType

model.pt is a standard PyTorch zip whose archive/data.pkl reconstructs and runs a code object at load time via two globals absent from picklescan's _unsafe_globals denylist (marshal.loads -> code object, types.FunctionType -> callable). picklescan <= 1.0.5 reports the file as clean.

Reproduce the scan bypass (version-independent — static scan)

pip install picklescan==1.0.5
python -m picklescan --path model.pt

Expected:

Scanned files: 1
Infected files: 0
Suspicious globals: 2
Dangerous globals: 0

Prove code execution (rebuilds payload for your Python, since marshal is version-specific)

python generate_payload.py

Expected: scan result: clean and marker: uid=... gid=... (output of id).

Affected: picklescan <= 1.0.5. CWE-693 / CWE-502.