pickle-scanner-bypass-marshal-poc

Pickle Scanner Bypass PoC — marshal.loads + types.FunctionType chain

Security research PoC submitted to huntr.com by ParallaxFx343.

malicious_model.pkl is a proof-of-concept pickle file that achieves arbitrary code execution while completely bypassing both major ML model security scanners:

• picklescan v1.0.4 → reports Infected files: 0, Dangerous globals: 0
• modelscan v0.8.8 → reports No issues found!

How it works

The payload chains three Python standard library calls that are not in either scanner's blocklist:

marshal.loads(bytecode)      -> code object   (reconstructs types.CodeType
                                                 without referencing it directly)
builtins.globals()           -> globals dict
types.FunctionType(code, g)  -> callable function
function()                   -> arbitrary code execution

types.CodeType is blocked by picklescan, but marshal.loads, types.FunctionType, and builtins.globals are not — despite marshal.loads being functionally equivalent to constructing a CodeType object.

Trigger conditions

Any code path that calls pickle.loads() / pickle.load() on this file — including torch.load(weights_only=False), joblib.load(), or direct pickle usage — will execute the embedded command. No user interaction is required beyond loading the file with a standard deserialization API.

Payload in this file

The embedded command is a harmless marker write for demonstration:

echo huntr_PoC_by_ParallaxFx343_pickle_scanner_bypass_executed > /tmp/huntr_poc_marker

This is a non-destructive proof-of-concept. It does not exfiltrate data, modify the host beyond writing a marker file, or persist itself.

Full technical writeup

See the accompanying huntr.com report for the complete root cause analysis, 20+ additional unblocked gadgets discovered during this research, and remediation recommendations.

Do not deserialize untrusted pickle files. This repository exists solely to demonstrate the scanner bypass for responsible disclosure purposes.