MomoFan/joblib-modelscan-bypass-poc

⚠️ ModelScan Bypass PoC — Joblib Scanner Evasion

SECURITY RESEARCH ONLY. Do NOT load these files in production.

Overview

This repository demonstrates 6 novel methods to bypass ProtectAI's ModelScan (v0.8.8, latest) through Joblib .joblib model files. All 6 payloads pass ModelScan with "No issues found" while executing code when loaded with joblib.load().

Bypass Methods

#	Module	Impact	Scanner Result
1	ctypes.CDLL	Load arbitrary native shared libraries (.so/.dylib)	✅ CLEAN
2	http.client.HTTPSConnection	Silent outbound HTTPS connection (data exfil)	✅ CLEAN
3	xmlrpc.client.ServerProxy	Remote procedure calls (C2 capability)	✅ CLEAN
4	io.open	Arbitrary file write	✅ CLEAN
5	logging.config.fileConfig	Config-based arbitrary class instantiation	✅ CLEAN
6	code.compile_command	Executable code object generation	✅ CLEAN

Root Cause

ModelScan's unsafe_globals blocklist in settings.py is incomplete. While it blocks obvious modules like os, subprocess, sys, and pickle, it misses many standard library modules with code execution or network capabilities:

• ctypes — Can load arbitrary native code via shared libraries
• http.client — Modern replacement for blocked httplib
• xmlrpc.client — XML-RPC remote procedure calls
• io — File I/O operations
• logging.config — Can instantiate arbitrary classes via config
• code — Code compilation and execution

Reproduction

pip install joblib numpy modelscan
python poc_joblib_scanner_bypass.py
# All 6 payloads: scanner CLEAN, execution confirmed

Tested Against

• ModelScan: 0.8.8 (latest as of March 2026)
• Joblib: 1.5.3
• Python: 3.12.13

Novelty

These bypasses use different module families than prior reports:

• CVE-2025-46417 covered linecache + ssl (picklescan)
• Feb 2026 modelscan-bypass-poc covered timeit, cProfile, profile, doctest
• This report covers ctypes, http.client, xmlrpc.client, io, logging.config, code