Views
No views yet
WARNING: This repository contains a proof-of-concept for a security vulnerability. The payload is benign (creates a text file). Do NOT load the.joblibfile unless you understand the risk.
.joblib files. It reports SCAN_NOT_SUPPORTED and skips them entirely — producing zero detections..pkl file is correctly detected as CRITICAL.| File | ModelScan Result | Issues Detected | ACE on Load? |
|---|---|---|---|
malicious_reference.pkl | Scanned | CRITICAL: 1 | Yes |
malicious_model.joblib | SKIPPED | 0 | Yes |
.joblib format (used by scikit-learn) has a two-layer deserialization architecture:Layer 1 (Pickle): NumpyArrayWrapper metadata ← scanners see this (safe)
Layer 2 (Binary): Array data as pickle stream ← hidden from scanners (malicious)dtype=object, joblib serializes the array data using pickle.dump() into a binary data section. On load, pickle.load() is called on this section — executing any embedded code..joblib format handler, so it skips these files completely.| File | Description |
|---|---|
malicious_model.joblib | PoC file — benign payload (writes a text file) |
malicious_reference.pkl | Same payload as .pkl for scanner comparison |
clean_model.joblib | Legitimate, safe .joblib file |
verify_bypass.py | Script to verify ModelScan bypass |
generate_poc.py | Script that generated the PoC files |
pip install modelscan joblib numpypython verify_bypass.pymalicious_reference.pkl → CRITICAL: 1 issue (eval detected)
malicious_model.joblib → 0 issues (SCAN_NOT_SUPPORTED)
[CONFIRMED] SCANNER BYPASS SUCCESSFUL!python verify_bypass.py --execute.joblib file via joblib.load() and confirms that the benign payload (text file creation) executes.SCAN_NOT_SUPPORTED for .joblib.joblib)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H