scanner-bypass-genops-poc

Security-research PoC — model-scanner bypass (picklescan / ModelScan)

This is a benign security-research proof-of-concept for a coordinated vulnerability disclosure to huntr's Model File Format program. It is not malware.

model.pt is an 89-byte PyTorch/pickle file that demonstrates a parser desync between the static model scanners (picklescan, ModelScan — both walk pickles with pickletools.genops, base-10 int parsing) and the real C unpickler (_pickle, base-0 int parsing). The 6-byte INT opcode I0x10\n makes the scanners' opcode walk abort before the payload, so both scanners report the file clean, while torch.load() executes the payload.

The payload is intentionally harmless: it writes a marker file to the system temp directory (NOMOS_SCANNER_BYPASS) to prove code execution. No data is exfiltrated, nothing is destroyed, there is no network activity and no self-propagation.

Reproduce

pip install picklescan==1.0.5 modelscan==0.8.8 torch
picklescan -p model.pt      # -> exit 0, PRISTINE (0 dangerous globals)
modelscan scan model.pt     # -> "No issues found"
python -c "import torch; torch.load('model.pt', weights_only=False)"   # -> marker written = code executed

Responsible-disclosure notes

• Reported to huntr's model-file program (their required submission mechanism is a public HuggingFace PoC repo).
• Suggested fix for the scanner maintainers: genops-based walkers must fail closed (UNSAFE) on any parse abort, and align INT opcode parsing with the C unpickler (or reject non-decimal INT args).

Full write-up: see the disclosure package accompanying this PoC.