manja316/modelscan-bypass-typing-rce

ModelScan Bypass PoC — typing+builtins.get_type_hints+type

Security research for responsible disclosure via Huntr MFV program.

Vulnerability

typing+builtins.get_type_hints+type is not in modelscan's unsafe_globals blocklist. When a pickle file containing this global is scanned by modelscan, it reports "No issues found." However, loading the file with pickle.loads() / torch.load() triggers FULL ARBITRARY CODE EXECUTION via eval() on type annotation strings.

Impact

• Severity: CRITICAL
• Effect: FULL ARBITRARY CODE EXECUTION via eval() on type annotation strings

Chain Details

1. builtins.type("X", (), {"__annotations__": {"x": "malicious_code"}}) — creates class with string annotation. builtins.type is NOT blocked (only eval/exec/getattr/etc are blocked from builtins).
2. typing.get_type_hints(class) — internally calls eval() on the annotation string, executing arbitrary Python code.
3. This is a two-step pickle chain achieving full RCE without using any blocked module.

Bypass Class

• builtins.type: Not in blocked builtins list (modelscan blocks eval, compile, getattr, apply, exec, open, breakpoint, import but NOT type)
• typing.get_type_hints: Not in blocklist at all
• Combined: full arbitrary code execution via eval()

Reproduction

pip install modelscan
modelscan scan -p bypass_poc.pkl
# Output: "No issues found!"