massyoh/modelscan-joblib-gzip-bypass-poc

Candidate A: ModelScan skips valid compressed .joblib.gz

This PoC creates a valid gzip-compressed joblib file using normal joblib.dump(..., compress=("gzip", 3)) behavior.

The payload is harmless: it writes /tmp/modelscan_joblib_gz_marker.

Reproduce

uv run --with modelscan --with joblib python poc.py

Expected scanner behavior observed locally:

• modelscan exits without detecting any issue.
• The file is reported as skipped with SCAN_NOT_SUPPORTED.
• joblib.load("exploit.joblib.gz") executes the payload.

Tested with:

• modelscan==0.8.8
• joblib==1.5.3