manja316/typing-hints-bypass-poc

Modelscan Bypass: typing.get_type_hints() Annotation Evaluation RCE

Summary

A pickle file can achieve arbitrary code execution while passing modelscan with 0 issues detected.

Technique

The bypass chains two unblocked modules:

1. builtins.type — creates a class with malicious __annotations__
2. typing.get_type_hints — evaluates annotation strings via internal eval() call

Why it bypasses modelscan:

• builtins.type: The builtins blocklist only covers eval, compile, getattr, apply, exec, open, breakpoint, __import__. type is NOT in this list.
• builtins.object: Same — object not in blocklist.
• typing.get_type_hints: The typing module is NOT in unsafe_globals at all.

How it achieves RCE:

typing.get_type_hints() internally calls eval() on forward reference annotation strings. By setting __annotations__ to contain Python code (e.g., __import__('os').system('...')), the eval executes arbitrary code.

The annotation [__import__('os').system('cmd'), int][-1] both executes the command AND returns int (a valid type), so get_type_hints() completes without error.

Impact

• Severity: Critical — Full RCE
• Affected: modelscan 0.7.6 (latest)
• File formats: .pkl, .pickle, .bin, .pt, .pth, .ckpt, .joblib, .dill, .dat, .data

Reproduction

import pickle
# Load exploit.pkl — triggers RCE
pickle.loads(open('exploit.pkl', 'rb').read())

Modelscan result

total_issues: 0

Fix

Add to unsafe_globals:

• typing: ["get_type_hints"] (or "*")
• builtins: add "type" to the existing list