modelscan Bypass PoC: _bootsubprocess.Popen RCE

Security research only. Do not use maliciously.

This model file demonstrates a bypass of protectai/modelscan v0.7.6.

Vulnerability

modelscan blocks subprocess but does NOT block _bootsubprocess, a CPython internal module that provides the same Popen functionality.

Verification

# Scan - reports no issues
modelscan scan -p model.pkl

# But executes arbitrary commands on load
python3 -c "import pickle; pickle.load(open('model.pkl','rb'))"

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support