metadata
license: apache-2.0
tags:
- security-research
- huntr
- model-file-security
- scanner-bypass
picklescan & ModelScan denylist gap: io.open (== builtins.open) via the un-denylisted io module
Benign security-research PoC for the huntr Model File Format program. The payload only writes a nonce marker file (echo / io.open) — no real harm, no network, no secrets (huntr §benign).
Vulnerability
Both scanners denylist builtins.open but miss io.open (the identical object) reached via the un-denylisted io module -> arbitrary file write at load. CLEANEST bypass: both scanners exit 0 with no error. Siblings: bz2/gzip/lzma.open, sqlite3.connect.
Measured evidence (2026-07-24)
Against picklescan 1.0.5 + ModelScan 0.8.8: both fail to flag; on load the benign marker fires. Re-verify: python -m nomos_redteam scanbypass.
Reproduce
import torch # or: import pickle
obj = torch.load("model.pt", weights_only=False) # fires the benign marker at load
Scan first to confirm the bypass:
picklescan -p model.pt # exit 0 / no dangerous global
modelscan -p model.pt # no issue reported