YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
Security-research PoC — model-scanner bypass (picklescan / ModelScan)
This is a benign security-research proof-of-concept for a coordinated vulnerability disclosure to huntr's Model File Format program. It is not malware.
model.pt is an 89-byte PyTorch/pickle file that demonstrates a parser desync between the static
model scanners (picklescan, ModelScan — both walk pickles with pickletools.genops, base-10 int parsing)
and the real C unpickler (_pickle, base-0 int parsing). The 6-byte INT opcode I0x10\n makes the
scanners' opcode walk abort before the payload, so both scanners report the file clean, while
torch.load() executes the payload.
The payload is intentionally harmless: it writes a marker file to the system temp directory
(NOMOS_SCANNER_BYPASS) to prove code execution. No data is exfiltrated, nothing is destroyed, there is
no network activity and no self-propagation.
Reproduce
pip install picklescan==1.0.5 modelscan==0.8.8 torch
picklescan -p model.pt # -> exit 0, PRISTINE (0 dangerous globals)
modelscan scan model.pt # -> "No issues found"
python -c "import torch; torch.load('model.pt', weights_only=False)" # -> marker written = code executed
Responsible-disclosure notes
- Reported to huntr's model-file program (their required submission mechanism is a public HuggingFace PoC repo).
- Suggested fix for the scanner maintainers:
genops-based walkers must fail closed (UNSAFE) on any parse abort, and align INT opcode parsing with the C unpickler (or reject non-decimal INT args).
Full write-up: see the disclosure package accompanying this PoC.