hacnho/h5py-create-dataset-scanner-bypass-poc

h5py create_dataset pickle-scanner bypass PoC

This PoC builds a raw pickle that uses dotted-name STACK_GLOBAL references to:

h5py._hl.files.File
h5py._hl.group.Group.create_dataset
h5py._hl.files.File.close

Both picklescan==1.0.4 and modelscan==0.8.8 report the pickle clean. A normal pickle.load() then creates /tmp/mfv_h5py_create_dataset_scanner_bypass_20260624.h5 and writes the dataset owned containing:

MFV_H5PY_CREATE_DATASET_SCANNER_BYPASS_20260624

Run:

python3 -m venv /tmp/h5py-create-dataset-scanner-bypass-venv
/tmp/h5py-create-dataset-scanner-bypass-venv/bin/python -m pip install --upgrade pip
/tmp/h5py-create-dataset-scanner-bypass-venv/bin/python -m pip install -r requirements.txt
/tmp/h5py-create-dataset-scanner-bypass-venv/bin/python reproduce_h5py_create_dataset_scanner_bypass.py

Expected:

picklescan_clean=True
modelscan_clean=True
load_success=True
marker_exists=True
readback=b'MFV_H5PY_CREATE_DATASET_SCANNER_BYPASS_20260624'
REPRO_OK

The payload is generated with raw pickle opcodes; it is not produced by pickling a bound method, so it does not contain builtins.getattr.