---
license: mit
tags:
  - security
  - poc
---

# torch.package (PyTorch Package MFV) — picklescan/modelscan bypass PoC

Proof-of-concept model files for a huntr Model File Vulnerability (MFV) report against
the **PyTorch Package (.pt)** format (`torch.package`).

## Files

- `malicious_interned.pt` — the actual vulnerability PoC. Runs `os.system("touch /tmp/torch_package_interned_pwned")`
  on load via `torch.package.PackageImporter(...).load_pickle(...)`. Both `picklescan` (1.0.4) and
  `modelscan` (0.8.8, made by Protect AI, huntr's parent org) report this file as **clean**
  ("Infected files: 0" / "No issues found"). `modelscan --show-skipped` explicitly lists the payload
  file (`archive/evilmodule.py`) as skipped: *"Model Scan did not scan file"*.
- `naive_detected_by_scanners.pt` — control/comparison file. Same RCE effect, but the pickle directly
  references `subprocess.Popen`. Both scanners correctly flag this one as dangerous. Included to isolate
  exactly which part of the technique causes the bypass (embedding the payload in the package's own
  *interned* Python source module instead of referencing a known-dangerous stdlib global from the pickle
  opcodes).

## Why the scanners miss it

`torch.package` archives are zip files that can bundle "interned" `.py` source modules alongside the
pickle data. When such a module is imported (which routinely happens as part of unpickling a package
object), `torch/package/package_importer.py`'s `PackageImporter._make_module()` runs
`exec(code, ns)` on that source directly. The pickle opcode stream itself never references anything
scanners treat as dangerous (`os.system`, `subprocess.Popen`, `eval`, etc.) — it just references
a custom, package-local class. Opcode-level scanners (picklescan, modelscan) have no model of this
second execution path, so they see nothing to flag.

## Reproduce

```bash
pip install torch picklescan modelscan
python3 -c "
import torch.package
picklescan_result = __import__('subprocess').run(['picklescan', '-p', 'malicious_interned.pt'])
"
picklescan -p malicious_interned.pt      # Infected files: 0
modelscan -p malicious_interned.pt        # No issues found! 🎉

python3 -c "
import torch.package
importer = torch.package.PackageImporter('malicious_interned.pt')
importer.load_pickle('archive', 'data.pkl')
"
ls -la /tmp/torch_package_interned_pwned  # created by the RCE
```

Full report: huntr.com MFV submission (PyTorch Package format).