Upload folder using huggingface_hub

README.md

@@ -0,0 +1,18 @@
+---
+license: apache-2.0
+tags: [security-research, huntr, model-file-security, scanner-bypass, pytorch]
+---
+# picklescan & ModelScan bypass: PyTorch .pt ZIP archive with an INT-opcode desync in data.pkl
+Benign security-research PoC for the huntr Model File Format program. Payload writes only a nonce marker (echo) — no real harm.
+## Vulnerability
+A modern PyTorch .pt is a ZIP archive; torch.load reads archive/data.pkl. Both picklescan and ModelScan recurse into the .pt archive and scan data.pkl (control: BOTH catch a plain malicious .pt). This PoC is a REAL torch.save archive whose data.pkl carries the INT-opcode desync prefix "I0x10\n": pickletools.genops parses base-10 and aborts before the payload, while torch.load(weights_only=False) parses "0x10" base-0 and executes the __reduce__ payload (arbitrary code execution at load). Defeats the archive-recursion scan on the exact format huntr receives ($1500 tier).
+## Measured (2026-07-24): picklescan 1.0.5 exit 0; ModelScan 0.8.8 no issue; torch.load(weights_only=False) fires the benign marker.
+## Reproduce
+```python
+import torch
+torch.load("model.pt", weights_only=False)   # fires the benign marker
+```
+```bash
+picklescan -p model.pt   # exit 0
+modelscan -p model.pt     # no issue
+```

model.pt

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:66809bcfadfffa00c9bf5e3a9bc5255779f6a10b41062ab945b6f277f07d5b97
+size 874