malicious-joblib-poc

Compressed Joblib Scanner Bypass PoC

Overview

This proof-of-concept demonstrates that a compressed .joblib model file can execute arbitrary system commands during joblib.load() while bypassing detection by common model security scanners.

This report targets the .joblib format. The selected target in Huntr is used as a placeholder since .joblib is not available in the dropdown.

This is not a standard deserialization issue, but a detection bypass where malicious behavior is executed while security scanners fail to identify it.

Key Finding

The only difference between the two model files is compression. The payload is identical:

• A normal .joblib file is correctly detected as malicious.
• A compressed .joblib file is NOT detected due to parsing errors.

Proof of Execution

Load the compressed model:

import joblib
joblib.load("demo_compressed.joblib")

After loading, a file named proof.txt is created containing system information:

cat proof.txt

Example output:

kali
Linux kali 6.16.8+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.16.8-1kali1 (2025-09-24) x86_64 GNU/Linux

Scanner Results

Normal joblib file

picklescan -p demo_model.joblib
modelscan -p demo_model.joblib

Result:

• Detected as unsafe / CRITICAL
• Unsafe operator: posix.system

Compressed joblib file

picklescan -p demo_compressed.joblib
modelscan -p demo_compressed.joblib

Result:

• No issues found
• Parsing error: opcode b'x' unknown
• Malicious payload not detected

Expected Behavior

Security scanners should detect unsafe operations inside compressed joblib files, just like uncompressed ones.

Actual Behavior

Scanners fail to parse compressed joblib files and incorrectly report them as safe, while the model still executes system commands during loading.

Impact

This enables silent code execution combined with scanner bypass. Users may rely on scanning tools and incorrectly trust malicious compressed .joblib models, creating a machine learning supply chain risk.

Environment

• Python 3.12.8
• joblib
• PickleScan
• ModelScan