GitHub Security Advisory: GHSA-4v6w-xpmh-gfgp
Package: skops (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-351: Insufficient Type Distinction
Vulnerable versions: < 0.12.0
Patched in: 0.12.0

Summary: Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time

Details:
## Summary

An inconsistency in `MethodNode` can be exploited to access unexpected object fields through dot notation. This can be used to achieve **arbitrary code execution at load time**.

While this issue may seem similar to https://github.com/skops-dev/skops/security/advisories/GHSA-m7f4-hrc6-fwg3, it is actually more severe, as it relies on fewer assumptions about trusted types.


## Details

The `MethodNode` allows access to attributes of existing objects via dot notation. However, there are several critical shortcomings:

* Although the `__class__` and `__module__` fields are checked via `get_untrusted_types` and during the `load` phase (as a concatenated string), **they are not actually used by `MethodNode`**. Instead, the `func` and `obj` entries in the `schema.json` are used to determine behavior. This means that even an apparently harmless `__module__.__class__` pair can lead to access of arbitrary attributes or methods of loaded objects, without any additional checks.

* **Nothing prevents an attacker from chaining multiple `MethodNode` instances** to traverse the object hierarchy and access harmful attributes.

An object can be loaded using the `ObjectNode`, which normally enforces strict checks and allows only trusted or explicitly permitted objects. However, once the object is loaded, dot notation can be used to access any of its attributes or methods. Furthermore, by chaining multiple `MethodNode`s, one can traverse the Python object hierarchy and reach dangerous components such as the `builtins` dictionary—which contains functions like `exec` and `eval`.

This vulnerability allows the attacker to **bypass both `get_untrusted_types` and `load` checks**, enabling access to dangerous attributes and methods without triggering any alerts. As demonstrated in the PoC, arbitrary code execution is possible using just an anonymous object returned by `get_untrusted_types` (in the example, `builtins.int`, though any type would suffice since it doesn't influence the exploit).


For example, consider a malicious `schema.json` snippet like:

```json
...
"__class__": "int",
"__module__": "builtins",
"__loader__": "MethodNode",
"content": {
  "obj": {
    "__class__": "int",
    "__module__": "builtins",
    "__loader__": "MethodNode",
    "content": {
      "obj": {
        "__class__": "QuadraticDiscriminantAnalysis",
        "__module__": "sklearn.discriminant_analysis",
        "__loader__": "ObjectNode",
        "__id__": 1
      },
      "func": "decision_function"
    }
  },
  "func": "__builtins__"
}
...
```

Here, the attacker loads a trusted `QuadraticDiscriminantAnalysis` object using `ObjectNode`, accesses its `decision_function` method via `MethodNode`, and then uses another `MethodNode` to access the `__builtins__` dictionary—**all without triggering the untrusted type detection mechanisms**.


## Proof of Concept (PoC)

The provided PoC demonstrates arbitrary code execution using only `builtins.int` as the type returned by `get_unt