Downloads · 30 days
0
picklescan-marshal-bypass-poc
0xzap/picklescan-marshal-bypass-poc
picklescan-marshal-bypass-poc is a machine learning model from 0xzap. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
model.pt is a standard PyTorch zip whose archive/data.pkl reconstructs and runs a code object at load time via two globals absent from picklescan's unsafeglobals denylist (marshal.loads - code object, types.FunctionTy…
Access
Public
Updated Jul 1, 2026
Repo size
676 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 37%
At a glance
- Access
- Public
- Created
- Jul 1, 2026
- Updated
- Jul 1, 2026
- SHA
- 1606012f
Model card
From the Hugging Face model README
picklescan bypass PoC — marshal.loads + types.FunctionType
model.pt is a standard PyTorch zip whose archive/data.pkl reconstructs and runs a code
object at load time via two globals absent from picklescan's _unsafe_globals denylist
(marshal.loads -> code object, types.FunctionType -> callable). picklescan <= 1.0.5
reports the file as clean.
Reproduce the scan bypass (version-independent — static scan)
pip install picklescan==1.0.5
python -m picklescan --path model.pt
Expected:
Scanned files: 1
Infected files: 0
Suspicious globals: 2
Dangerous globals: 0
Prove code execution (rebuilds payload for your Python, since marshal is version-specific)
python generate_payload.py
Expected: scan result: clean and marker: uid=... gid=... (output of id).
Affected: picklescan <= 1.0.5. CWE-693 / CWE-502.
- Created
- Jul 1, 2026
- Updated
- Jul 1, 2026