| # PoC - modelaudit misses numpy.savez file-write-on-load (Pickle) | |
| Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only. | |
| - Scanner under test: `modelaudit==0.2.49` (cross-checked `modelscan==0.8.8`), Python 3.11.15, numpy 2.4.6. | |
| - Format: Pickle (.pkl). | |
| - Two-sided behavior: `modelaudit scan evil_savez.pkl` -> **Clean / exit 0** (7/7 checks pass), but | |
| `pickle.load(open('evil_savez.pkl','rb'))` writes a `.npz` to an attacker-controlled absolute path on load. | |
| - Benign marker: the reduce calls `numpy.savez(<marker_path>, [13.37])` - a harmless array write. No destructive action. | |
| - Root cause: modelaudit's pickle FILE_WRITE call-graph sink table (`_FILE_OPEN_SINK_EXACT`) omits `zipfile.ZipFile`, | |
| so `numpy.savez`/`savez_compressed` (whose open is mediated by zipfile) evade the detector that catches `numpy.save`. | |
| Files: `evil_savez.pkl` (scan Clean), `build_gadgets.py` (builder). Full report + positive control in the huntr submission. | |