skops-zip-bomb-256m-poc

skops_zip_bomb_256m.skops PoC

This repository contains a proof-of-concept malformed .skops model file for a memory exhaustion issue in skops-dev/skops.

Files

• skops_zip_bomb_256m.skops: compressed PoC model file.
• poc.py: optional script to regenerate and exercise the PoC locally.

Tested Target

• Repository: https://github.com/skops-dev/skops
• Version: 0.15.dev0
• Commit: f61636d4334ebb3a84546cdb47cf2cff670e0436

Reproduction

python -m pip install "numpy>=1.25.0" "scipy>=1.10.0" "scikit-learn>=1.2" "prettytable>=3.9" "packaging>=17.0" skops
python poc.py

Expected behavior:

• The compressed .skops file is about 255 KiB.
• The referenced ZIP member expands to 256 MiB.
• skops.io.load() forces the member to be decompressed into memory before rejecting the malformed NumPy content.
• skops.io.get_untrusted_types(file=...) returns [], while also processing the large member.

This PoC is intentionally capped at 256 MiB to avoid excessive resource use.