Proof-of-concept files demonstrating that ModelScan's unsafe_globals allowlist omits four additional code-execution primitives beyond those already disclosed in issues #338, #331, and PR #339 on protectai/modelscan:
operator.methodcaller
functools.partial
atexit.register
threading.Thread
The bypass affects every extension PickleUnsafeOpScan is dispatched to via FormatViaExtensionMiddleware: .pkl, .pickle, .joblib, .dill, .dat, .data. A .joblib variant (R2_A1-09_threading.joblib) is included as concrete demonstration that the .joblib extension routes to the same scanner and yields the same total_issues: 0 result.
These files are intentionally malicious for demonstration purposes. Do not load any of them on a system you care about.
See the huntr submission for the detailed Description.
These proof-of-concept files were generated with AI-assisted analysis and manually verified in a clean environment against vanilla pip install modelscan==0.8.8.
