PoC: modelscan 0.8.8 multi-pickle legacy scan bypass (scanner evasion)
Coordinated-disclosure proof-of-concept submitted to huntr. The model file in this repository is a benign test artifact: its payload only runs
touch MP_legacy_pwn(creates an empty marker file in the working directory). No network access, no destructive action. Do not load untrusted model files.
What this demonstrates
modelscan 0.8.8 reports evil_legacy.pt as clean ("No issues found! 🎉", exit 0), yet
torch.load("evil_legacy.pt", weights_only=False) executes the payload. The identical
os.system operator in a single-stream pickle is flagged — so this is a scan-coverage
correctness defect, not a denylist gap.
This is a scanner-evasion finding (huntr "unique methods to bypass our automated
scanners"), not a report of pickle deserialization itself. Root cause: scan_pytorch()
(modelscan/tools/picklescanner.py) calls scan_pickle_bytes(..., multiple_pickles=False),
so _list_globals() breaks after the first of the file's sequential pickle streams and
never inspects the model object graph.
How the PoC model was created
A well-formed 5-stream PyTorch legacy file: magic number, protocol, sys_info, the
os.system payload object, and an empty storage-keys list (so torch.load returns
without error — a valid file, not malformed). See poc.py.
Files
evil_legacy.pt— the malicious-but-benign model file (modelscan-clean, executes on load).poc.py— self-contained: builds the file, scans it (clean), loads it (executes), and runs a single-stream control (flagged). One command.
Reproduce
pip install "modelscan==0.8.8" torch
modelscan -p evil_legacy.pt # -> No issues found! 🎉 (exit 0)
python -c "import torch; torch.load('evil_legacy.pt', weights_only=False)" # -> creates MP_legacy_pwn
python poc.py # full differential, prints: RESULT: PASS
Affected / fix
modelscan 0.8.8 (latest at disclosure). Fix: pass multiple_pickles=True in the PyTorch
legacy scan path (scan_pytorch), matching the non-legacy behaviour.