---
license: mit
tags:
  - security-poc
  - coordinated-disclosure
---

# PoC: modelscan 0.8.8 multi-pickle legacy scan bypass (scanner evasion)

> Coordinated-disclosure proof-of-concept submitted to huntr. The model file in this
> repository is a **benign test artifact**: its payload only runs `touch MP_legacy_pwn`
> (creates an empty marker file in the working directory). No network access, no
> destructive action. Do not load untrusted model files.

## What this demonstrates
`modelscan` 0.8.8 reports `evil_legacy.pt` as clean ("No issues found! 🎉", exit 0), yet
`torch.load("evil_legacy.pt", weights_only=False)` executes the payload. The identical
`os.system` operator in a single-stream pickle **is** flagged — so this is a scan-coverage
correctness defect, not a denylist gap.

This is a **scanner-evasion** finding (huntr "unique methods to bypass our automated
scanners"), not a report of pickle deserialization itself. Root cause: `scan_pytorch()`
(`modelscan/tools/picklescanner.py`) calls `scan_pickle_bytes(..., multiple_pickles=False)`,
so `_list_globals()` breaks after the first of the file's sequential pickle streams and
never inspects the model object graph.

## How the PoC model was created
A well-formed 5-stream PyTorch legacy file: magic number, protocol, sys_info, the
`os.system` payload object, and an empty storage-keys list (so `torch.load` returns
without error — a valid file, not malformed). See `poc.py`.

## Files
- `evil_legacy.pt` — the malicious-but-benign model file (modelscan-clean, executes on load).
- `poc.py` — self-contained: builds the file, scans it (clean), loads it (executes), and runs a single-stream control (flagged). One command.

## Reproduce
```
pip install "modelscan==0.8.8" torch
modelscan -p evil_legacy.pt        # -> No issues found! 🎉  (exit 0)
python -c "import torch; torch.load('evil_legacy.pt', weights_only=False)"   # -> creates MP_legacy_pwn
python poc.py                       # full differential, prints: RESULT: PASS
```

## Affected / fix
modelscan 0.8.8 (latest at disclosure). Fix: pass `multiple_pickles=True` in the PyTorch
legacy scan path (`scan_pytorch`), matching the non-legacy behaviour.