You can deploy this model and start earning money today!

Skyflocka/
pickle-importlib-rce-poc

Name: pickle-importlib-rce-poc
Availability: InStock

Views

No views yet

Pickle .pkl RCE PoC - importlib.import_module + operator.methodcaller ModelScan Bypass

Vulnerability

Malicious .pkl file achieves Remote Code Execution using importlib.import_module + operator.methodcaller, bypassing ModelScan's unsafe_globals blocklist.

ModelScan Bypass

ModelScan's PickleUnsafeOpScan extracts GLOBAL/STACK_GLOBAL opcodes and checks against unsafe_globals. This payload only uses:

importlib.import_module (NOT in blocklist)
operator.methodcaller (NOT in blocklist - only operator.attrgetter is blocked)

Reproduction

python

import pickle
with open("model.pkl", "rb") as f:
    model = pickle.load(f)  # RCE occurs here

Check /tmp/pickle_rce_proof for execution evidence.

Impact

Arbitrary command execution when a user loads a malicious .pkl model file.

Skyflocka/pickle-importlib-rce-poc