Security research PoC for responsible disclosure via huntr.com.
Files
safe_demo.joblib: Calls pip.main(["--version"]) when loaded. Bypasses ModelScan.
rce_proof.joblib: Calls pip.main(["install", ...]) when loaded. Bypasses ModelScan.
Vulnerability
ModelScan v0.8.8 does not include pip in its unsafe globals blacklist.
A malicious .joblib file can call pip.main() to install arbitrary packages,
which can execute arbitrary code via setup.py.
Reproduction
python
1from modelscan.modelscan import ModelScan
2scanner = ModelScan()3result = scanner.scan("safe_demo.joblib")4print(result["summary"])# total_issues: 056import joblib
7joblib.load("safe_demo.joblib")# prints pip version
Disclosure
Submitted via huntr.com Model File Vulnerability program.
