daupaul/huntr-modelscan-npz-runstring-rce-poc

huntr MFV PoC - modelscan NPZ + runstring arbitrary code execution

Harmless reproducer for a huntr Model File Vulnerability report.

The inner pickle calls numpy.testing._private.utils.runstring(<python>, {}) at unpickle time. The function is def runstring(astr, dict): exec(astr, dict), a direct exec wrapper.

Scanner behavior

• modelscan 0.8.8 reports this artifact as clean with rc=0.
• picklescan 1.0.4 reports dangerous import 'numpy.testing._private.utils runstring' FOUND.
• fickling 0.1.7 classifies the same primitive as Severity.LIKELY_OVERTLY_MALICIOUS.

Loading with numpy.load(..., allow_pickle=True) writes a marker file to the platform temporary directory, proving arbitrary Python execution during model-file load. The PoC does not start processes, make network requests, or access sensitive files.

Supplemental verification - 2026-05-19

The issue was re-verified against the latest published modelscan release available during retest:

• Python 3.12.13
• NumPy 2.0.2
• modelscan 0.8.8
• picklescan 1.0.4
• fickling 0.1.7

modelscan -p runstring_rce.npz returned No issues found! with exit code 0. The same artifact was flagged by picklescan and fickling, and executing numpy.load('runstring_rce.npz', allow_pickle=True)['arr'].item() created the expected marker file.

The practical impact is a documented model-scanning gate workflow: an untrusted NPZ artifact can receive a clean modelscan decision before a downstream NumPy object-array load executes attacker-controlled Python under the loading process privileges.

The latest local evidence is included in modelscan_npz_runstring_rce_gap_evidence.json. Local verification script: projects/huntr-mfv/scripts/verify_modelscan_npz_runstring_rce.py