poc-joblib-modelscan-bypass

joblib + ProtectAI/modelscan bypass — defensive PoC

This repo hosts a proof-of-concept malicious joblib artifact for a disclosure to the huntr.com Model File Vulnerability program.

Do not load this file in production. It is a real ACE payload, kept benign (writes a sentinel file /tmp/PWNED_BY_JOBLIB_PoC).

What it shows

joblib.dump(obj, "x.joblib", compress=3) writes a zlib-compressed pickle. The zlib magic byte (0x78) at offset 0 is not a valid pickle opcode, so pickletools.genops -- which is what ProtectAI modelscan uses to walk opcodes -- aborts early with a parsing error and reports "No issues found". The actual payload survives because joblib.load(...) decompresses first, then unpickles, so the RCE constructor (__reduce__) fires.

Reproduce

pip install joblib==1.5.3 modelscan==0.8.8

# 1) modelscan should incorrectly mark this as clean
modelscan -p iris_classifier.joblib
#   ... No issues found! ...
#   ... Parsing error: at position 0, opcode b'x' unknown

# 2) joblib.load runs the embedded payload
python3 -c "import joblib; joblib.load('iris_classifier.joblib')"
ls -la /tmp/PWNED_BY_JOBLIB_PoC

The same trick works with compress=('lzma',3), ('gzip',3), ('bz2',3), ('xz',3) and the default compress=9 -- every joblib compression mode bypasses the pickle scanner, while raw .pkl and uncompressed .joblib are correctly flagged.

Affected scanner / pipeline

• protectai/modelscan (PyPI 0.8.8 -- latest at 2026-04-30)
• huggingface.co's automated model-file scan (powered by ProtectAI), which is the gate for surfacing the "Detected Pickle imports" warning on a model card.

Disclosure

Reported via huntr.com.