You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Picklescan v1.0.4 Bypass — dataclasses._create_fn RCE

⚠️ Security Research — Do NOT load the .pkl file with pickle.loads() ⚠️

This repository contains a proof-of-concept demonstrating a bypass of picklescan v1.0.4's safety scanning. The malicious pickle file passes picklescan with 0 dangerous findings but achieves arbitrary code execution when loaded.

Attack Vector

dataclasses._create_fn() internally calls exec() on Python source code built from its parameters. By injecting a malicious default argument expression, we achieve RCE with a single unblocked function call.

Files

bypass_dataclasses.pkl - Malicious pickle payload (107 bytes)
bypass_dataclasses_poc.py - Full PoC script with picklescan verification

Disclosure

Submitted via huntr.com Model File Vulnerability Program.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support