massyoh/mailcap-findmatch-scanner-bypass-poc

Candidate F: mailcap.findmatch unsafe pickle global missed by scanners

This PoC creates a pickle payload whose reducer calls mailcap.findmatch. mailcap.findmatch evaluates the test command in a matching mailcap entry via os.system().

The payload writes /tmp/mailcap_findmatch_pickle_marker.

Observed locally with modelscan==0.8.8 and picklescan==1.0.4:

• ModelScan scans the file and reports 0 issues.
• PickleScan scans the file and reports mailcap.findmatch as suspicious, but not dangerous, and exits 0.
• pickle.load("mailcap_findmatch_payload.pkl") executes the payload.

Run:

uv run --with modelscan==0.8.8 --with picklescan==1.0.4 python poc.py