xiaoyaoes/pickle-bypass-mailcap-findmatch-poc

Pickle Scanner Bypass via mailcap.findmatch

Bypasses picklescan and modelscan.

The Vulnerability

Python's deprecated mailcap module (removed in Python 3.13) exposes findmatch() which executes mailcap entry test commands via os.system(). Neither scanner blocks mailcap imports.

How it works

1. pickle.loads() imports mailcap.findmatch
2. Calls findmatch(caps, type, 'view', filename) where caps contains a crafted entry with 'test': '<shell_command>'
3. findmatch() internally runs os.system(test_command)

Files

• malicious.pkl — Minimal pickle payload (140 bytes)
• poc.py — Python script that generates and demonstrates the payload