You can deploy this model and start earning money today!

jeikei97/
modelscan-pytorch-zip-gadget-chain-bypass

Name: modelscan-pytorch-zip-gadget-chain-bypass
Availability: InStock

Views

No views yet

modelscan-pytorch-zip-gadget-chain-bypass

This repository contains a proof of concept for a scanner bypass in modern ZIP-based PyTorch .pt model files.

Vulnerability

The open-source protectai/modelscan scanner correctly opens ZIP-based PyTorch archives and scans the embedded data.pkl pickle. However, it still relies on a static unsafe-global blacklist, which can be bypassed by a higher-order gadget chain whose imported globals look benign.

The included payload uses only:

operator.methodcaller
importlib.import_module

At deserialization time, those globals compose into the equivalent of:

operator.methodcaller("system", "touch PT_MARKER.txt")(importlib.import_module("os"))

This means torch.load(..., weights_only=False) executes the payload even though modelscan reports zero issues and zero errors.

Primary PoC

The main PoC file is:

artifacts/gadget_zip_pytorch.pt

The payload is harmless. When loaded through the unsafe path, it creates a local marker file:

PT_MARKER.txt

Included Files

artifacts/gadget_zip_pytorch.pt
artifacts/reproduce_output.txt
artifacts/sha256sums.txt
reproduce.py

Tested Environment

Date tested: July 16, 2026
Python: 3.13.12
PyTorch: 2.13.0+cpu
modelscan: protectai/modelscan @ 61fcec9c2a37c24c1fb12d84ede30fe248a364bd

Reproduction

1. Verify the included PoC

Run:

python reproduce.py --modelscan-path /path/to/modelscan

If modelscan is already installed in your environment, --modelscan-path is optional.

Expected results:

modelscan returns zero issues and zero errors
torch.load(..., weights_only=False) loads successfully
the payload creates PT_MARKER.txt
the returned object is still an OrderedDict

2. Rebuild the artifact from a clean ZIP-based `.pt` template

Run:

python reproduce.py --build --template-pt /path/to/clean_zip_pytorch.pt --modelscan-path /path/to/modelscan

The clean template must be a ZIP-based PyTorch archive with a data.pkl member. This regenerates artifacts/gadget_zip_pytorch.pt and reruns the verification steps.

Important Nuance

Recent PyTorch versions changed the default torch.load behavior to weights_only=True, which blocks unsafe globals earlier in the load pipeline.

The vulnerable / unsafe path demonstrated here is:

torch.load(path, weights_only=False)

That is the deserialization-equivalent path relevant to file-format ACE discussions and to environments that explicitly disable the safer default or use older behavior.

Observed Results

From artifacts/reproduce_output.txt:

modelscan_issue_count: 0
modelscan_errors: []
torch_load_type: OrderedDict
torch_load_keys: []
marker_exists_after_torch_load: True

Impact

This is a practical semantic scanner bypass for a real PyTorch archive format:

the file is a valid ZIP-based .pt model artifact
modelscan inspects the embedded data.pkl
the imported globals look benign under the current blacklist policy
the unsafe PyTorch load path still reaches code execution

Notes

The included artifact is intentionally harmless and only creates a local marker file.
This bypass does not depend on malformed ZIP structure or parse errors.

jeikei97/modelscan-pytorch-zip-gadget-chain-bypass