neimasilk/modelscan-compression-bypass-poc

ModelScan Compression Bypass PoC

Security research PoC for responsible disclosure via huntr.com.

Files

• detected_uncompressed.joblib: os.system payload WITHOUT compression. ModelScan DETECTS this (1 CRITICAL).
• bypass_zlib.joblib: SAME os.system payload WITH zlib compression. ModelScan reports 0 issues.
• bypass_lz4.joblib: SAME os.system payload WITH lz4 compression. ModelScan reports 0 issues.

Vulnerability

ModelScan v0.8.8 cannot parse compressed joblib files. When joblib.dump() uses compress=3 (zlib) or compress=("lz4", 3), the pickle bytes are compressed. ModelScan's pickletools.genops() cannot parse compressed bytes, so it silently returns no findings.

However, joblib.load() automatically decompresses and unpickles, executing the malicious payload.

Reproduction