Skyflocka/joblib-importlib-rce-poc

Joblib RCE PoC - importlib.import_module + operator.methodcaller ModelScan Bypass

Vulnerability

Malicious .joblib file achieves Remote Code Execution via pickle deserialization using importlib.import_module + operator.methodcaller, bypassing ModelScan's unsafe_globals blocklist.

ModelScan Bypass

ModelScan's pickle scanner checks GLOBAL/STACK_GLOBAL opcodes against a blocklist. This payload only uses:

• importlib.import_module (NOT in blocklist)
• operator.methodcaller (NOT in blocklist - only operator.attrgetter is blocked)

These two functions are chained to achieve arbitrary command execution:

1. importlib.import_module("os") dynamically imports the os module
2. operator.methodcaller("system", cmd) creates a callable that invokes .system(cmd)
3. Applying the methodcaller to the os module executes os.system(cmd)

Reproduction

import joblib
model = joblib.load("model.joblib")  # RCE occurs here

Check /tmp/joblib_rce_proof for execution evidence.

Impact

Arbitrary command execution when a user loads a malicious .joblib model file.