YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
Security PoC — torch.package scanner member-selection bypass → unconditional code execution (huntr MFV)
Security-research PoC for a huntr MFV submission. Not malware — the payload only writes a harmless /tmp marker.
model_scanskip.pt executes code at the default PackageImporter.load_pickle() while both modelscan and picklescan report no issues — because neither scanner ever parses the malicious member (modelscan selects a member's format by file extension; picklescan scans a member only if it has a pickle extension or a leading \x80). The payload is a proto-0 builtins.eval pickle stored as a non-pickle-extension member.
Environment
pip install torch==2.13.0 modelscan==0.8.8 picklescan==1.0.4 # Python 3.10
Reproduce
modelscan -p model_scanskip.pt # -> "No issues found! 🎉" (malicious member skipped)
picklescan -p model_scanskip.pt # -> "Scanned files: 0, Infected files: 0"
rm -f /tmp/huntr_r2_scanskip
python load.py # -> marker AFTER: True, contents: PWNED_R2_SCANSKIP
Controls: controlA_proto2_storage.pt (proto-2 → picklescan catches it) and controlB_proto0_dill.zip (.dill name → modelscan catches it) prove only the specific combo (non-pickle-ext + proto-0/1) evades both. craft.py shows how the file is built.