You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

ModelScan Bypass PoC: operator.methodcaller + importlib.import_module

⚠️ SECURITY RESEARCH ONLY — This repository contains a proof-of-concept for a modelscan scanner bypass.

Vulnerability

modelscan v0.8.8 fails to detect malicious pickle payloads that use:

importlib.import_module() to dynamically load blocked modules
operator.methodcaller() to invoke methods on imported modules

Both references pass the scanner's blocklist check, resulting in 0 issues reported while the payload achieves arbitrary command execution.

Files

create_poc.py — Script to generate the malicious model files
pytorch_model.bin — PyTorch-format PoC (passes modelscan, executes with torch.load)

Reproduction

# Install modelscan
pip install modelscan

# Scan the model file — reports "No issues found"
modelscan scan -p pytorch_model.bin

# Load with torch — executes arbitrary command
python3 -c "import torch; torch.load('pytorch_model.bin', weights_only=False)"

Disclosure

Submitted to ProtectAI via Huntr responsible disclosure program.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support