You can deploy this model and start earning money today!

wladislax/
joblib-modelscan-bypass-ace-poc

joblib

security

vulnerability-research

Views

No views yet

⚠️ Security PoC — NOT a usable model

Proof-of-concept malicious .joblib files for a huntr "Model Format Vulnerability" submission (Protect AI / Palo Alto Prisma AIRS). They achieve arbitrary code execution on joblib.load() while being reported clean by Protect AI ModelScan. Published only for responsible-disclosure reproduction. Do not load them on a machine you care about.

What it demonstrates

joblib.load() deserializes via pickle, so an object's __reduce__ runs code on load. ModelScan's pickle scanner is a module-name denylist; choosing a code-execution gadget whose module is not on that denylist yields RCE that ModelScan does not flag.

File	Gadget	ModelScan
`poc.joblib`	`pydoc.pipepager(text, cmd)` → `subprocess.Popen(cmd, shell=True)`	0 issues
`poc2_cprofile.joblib`	`cProfile.run(stmt)` → `exec(stmt)`	0 issues
`naive_os_system.joblib`	`os.system(cmd)` (contrast)	CRITICAL — detected

The two gadgets show the bypass is structural: patching one module does not close the class. The proof command is non-destructive — it only writes a marker file.

Reproduce

bash

python -m pip install joblib modelscan
python load_poc.py poc.joblib        # -> writes joblib_poc_pwned.txt  (RCE)
modelscan -p poc.joblib -r json      # -> total_issues: 0  (bypass)
modelscan -p naive_os_system.joblib  # -> CRITICAL  (control is caught)

Files

poc.joblib — RCE via pydoc.pipepager, bypasses ModelScan
poc2_cprofile.joblib — RCE via cProfile.run, bypasses ModelScan
naive_os_system.joblib — control payload ModelScan flags CRITICAL
make_joblib_poc.py — regenerates all three deterministically
load_poc.py — minimal loader proving execution

wladislax/joblib-modelscan-bypass-ace-poc

⚠️ Security PoC — NOT a usable model

What it demonstrates

Reproduce

Files

wladislax/
joblib-modelscan-bypass-ace-poc