huntr MFV PoC - modelscan NPZ + runstring arbitrary code execution
Harmless reproducer for a huntr Model File Vulnerability report.
The inner pickle calls numpy.testing._private.utils.runstring(<python>, {}) at unpickle time. The function is def runstring(astr, dict): exec(astr, dict), a direct exec wrapper.
Scanner behavior
modelscan 0.8.8 reports this artifact as clean with rc=0.picklescan 1.0.4 reports dangerous import 'numpy.testing._private.utils runstring' FOUND.fickling 0.1.7 classifies the same primitive as Severity.LIKELY_OVERTLY_MALICIOUS.
Loading with numpy.load(..., allow_pickle=True) writes a marker file to the platform temporary directory, proving arbitrary Python execution during model-file load. The PoC does not start processes, make network requests, or access sensitive files.
Supplemental verification - 2026-05-19
The issue was re-verified against the latest published modelscan release available during retest:
- Python 3.12.13
- NumPy 2.0.2
- modelscan 0.8.8
- picklescan 1.0.4
- fickling 0.1.7
modelscan -p runstring_rce.npz returned No issues found! with exit code 0. The same artifact was flagged by picklescan and fickling, and executing numpy.load('runstring_rce.npz', allow_pickle=True)['arr'].item() created the expected marker file.
The practical impact is a documented model-scanning gate workflow: an untrusted NPZ artifact can receive a clean modelscan decision before a downstream NumPy object-array load executes attacker-controlled Python under the loading process privileges.
The latest local evidence is included in modelscan_npz_runstring_rce_gap_evidence.json. Local verification script: projects/huntr-mfv/scripts/verify_modelscan_npz_runstring_rce.py
