aslein1413/poc-hickle-safe-bypass-rce

PoC — hickle's safe=True does not stop code execution (.h5)

hickle.load(file, safe=True) documents safe as the control that disables automatic depickling of untrusted files. On any hickle 4.x+ file that control is silently ignored, so a malicious .h5 runs its pickled payload even when you explicitly ask for a safe load. This is a documented security option that does nothing, not just "pickle is unsafe".

Files

• poc_hickle_safe.h5 — a hickle file carrying a pickled __reduce__ payload (id).
• verify.py — loads it with hickle.load("poc_hickle_safe.h5", safe=True).

Reproduce

pip install hickle
python verify.py
# marker after : True
# uid=0(root) ...
# HICKLE_SAFE_TRUE_BYPASS

Confirmed on a clean python:3.12-slim container with stock hickle 5.0.3.

Why it matters

Callers who followed the docs and passed safe=True believe they are protected; they are not. Loading an untrusted .h5 runs attacker code as the host process. ModelScan does not recognize hickle's HDF5 layout, so the file also scans clean.