You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Modelscan Bypass PoC — marshal.loads + types.FunctionType

Security Research — Authorized Vulnerability Disclosure

This model file demonstrates a bypass of ProtectAI's modelscan scanner. The pickle payload uses marshal.loads() and types.FunctionType() to achieve code execution. Neither module is in modelscan's blocklist.

Bypass Chain

marshal.loads(bytes) → reconstructs code object from marshaled bytecode
types.FunctionType(code_obj, {}) → creates callable function
func() → executes embedded code

Impact

modelscan reports "No issues found" for this file
torch.load() or pickle.load() executes arbitrary code

PoC Verification

modelscan scan -p pytorch_model.bin  # -> No issues found
python3 -c "import pickle; pickle.load(open('pytorch_model.bin', 'rb'))"  # -> RCE

Responsible Disclosure

Submitted to ProtectAI via Huntr MFV program.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support