metadata
tags:
- security-research
- modelscan-bypass
license: mit
Modelscan Bypass PoC: gettext.install builtins modification
Security research only. Do not use for malicious purposes.
Summary
Calls gettext.install() which modifies builtins by adding _() function. gettext is not in modelscan's unsafe_globals blocklist. Modifies Python builtins at load time.
Reproduction
pip install modelscan
modelscan scan -p pytorch_model.bin
# Result: No issues found
python3 -c "import pickle; pickle.load(open('pytorch_model.bin', 'rb'))"
# Result: Code executes
Affected
- modelscan 0.7.6 (latest as of 2026-04-11)
Disclosure
Submitted to ProtectAI via Huntr.