SafeTensors I8 Polyglot — picklescan Format-Level Bypass
MFV Format: SafeTensors (.safetensors) — $4,000
Scanner: picklescan 1.0.4
Result: 0 issues detected (complete bypass)
Summary
SafeTensors I8 tensor can embed arbitrary pickle payloads. picklescan 1.0.4 does not scan inside SafeTensor file data — it has no format-level parsing for .safetensors files. An I8 tensor containing a pickle payload passes with 0 issues.
Files
bypass_poc.safetensors — SafeTensors file with I8 tensor containing pickle RCE payloadpoc.py — PoC script to generate and verify the bypass
Disclosure
Reported through Huntr MFV program.
