Modelscan Bypass: marshal.loads() β Code Object Deserialization
β οΈ SECURITY RESEARCH ONLY
Vulnerability
marshal.loads() deserializes Python code objects from bytes. Combined with types.FunctionType(), this enables constructing arbitrary executable functions from raw bytecode.
Impact
- Type: Code Injection β Deserialize arbitrary Python bytecode
- Step 1 of a code execution chain
- Modelscan result: "No issues found"
Responsible Disclosure
Gated access. Reported to ProtectAI via Huntr.
Inference Providers NEW
This model isn't deployed by any Inference Provider. π Ask for provider support