modelaudit-flax-msgpack-embedded-pickle-poc

PoC - modelaudit FlaxMsgpackScanner embedded-pickle blind spot in bin/ext leaves (BL-0110)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.

• Scanner: modelaudit==0.2.49 (flax_msgpack_scanner.py). Format: Flax (.flax) / MessagePack (.msgpack).
• modelaudit scan bypass_bin.flax -> Clean / exit 0, but a live os.system pickle is embedded in a msgpack bin leaf; a downstream consumer that pickle.loads the leaf executes it. The byte-identical 108-byte payload is rated CRITICAL by modelaudit's own pickle scanner. control_suspicious_string.flax fires CRITICAL (detector is live); truneg_benign_bin.flax is the negative baseline.
• Root cause: flax_msgpack_scanner.py:2464-2476 UTF-8-decodes bin leaves and only regex-scans them (no pickle opcode check); ext leaves (:2454-2462) take the same regex-only path. A REDUCE pickle stores its global as posix/system so 'os.system' never appears as a literal substring -> evades. Payload-selective (subprocess would be caught).
• Benign: the pickle only touches a marker file on load. Honest caveat: flax itself does not unpickle; a consumer pickle.loads does.

Files: bypass_bin.flax + bypass_ext99.msgpack (bypass), control_suspicious_string.flax (fires), truneg_benign_bin.flax. Full report in huntr submission.