| # Security-research PoC — ModelScan bypass via profile.run gadget (benign, huntr disclosure) | |
| `model.pkl` calls `profile.run(code)` at unpickle — a stdlib profiler whose `.run()` executes arbitrary code | |
| via `exec()`. ModelScan's denylist omits the profilers, so it reports "No issues found"; the payload writes a | |
| benign marker to temp. Reproduce: `modelscan scan model.pkl` (clean) then `python -c "import pickle;pickle.load(open('model.pkl','rb'))"` (marker written = exec). Fix: add profile/cProfile/pstats to the denylist. | |