modelscan-bypass-xmlrpc

ProtectAI modelscan Bypass PoC

Module: xmlrpc proxy Impact: xmlrpc.client.ServerProxy bypass - RPC to attacker server Scanner: modelscan 0.7.6 (latest on PyPI) Result: "No issues found" — bypass confirmed

Reproduction

pip install modelscan
modelscan scan -p xmlrpc_proxy.pkl
# Output: "No issues found!"
# But pickle.load() executes the payload

Responsible Disclosure

This PoC is uploaded for responsible disclosure via Huntr MFV program.