Downloads · 30 days
0
poc-torch-legacy-pt-modelscan-bypass
thesecguy/poc-torch-legacy-pt-modelscan-bypass
poc-torch-legacy-pt-modelscan-bypass is a machine learning model from thesecguy. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Do not load this file in production. This is a real ACE payload, kept benign (writes a sentinel file /tmp/PWNEDBYPTLEGACY).
Access
Public
Updated Apr 30, 2026
Repo size
663 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 46%
At a glance
- Access
- Public
- Created
- Apr 30, 2026
- Updated
- Apr 30, 2026
- SHA
- 8c932235
Model card
From the Hugging Face model README
Defensive PoC: PyTorch legacy .pt format -- ProtectAI / HuggingFace pickle scanner bypass
Do not load this file in production. This is a real ACE payload, kept benign
(writes a sentinel file /tmp/PWNED_BY_PT_LEGACY).
What it shows
torch.save(obj, path, _use_new_zipfile_serialization=False) writes a raw
PROTO-2 pickle (the legacy non-zipfile format that PyTorch < 1.6 used by default
and that current PyTorch still emits when callers pass the legacy flag, or load
old checkpoints from libraries pinned to old torch).
ProtectAI modelscan dispatches by file extension: .pt -> PyTorchUnsafeOpScan.
That scanner assumes the modern zipfile-wrapped format and reports "No issues
found" on a legacy-format .pt even when the embedded pickle calls
os.system(...) via __reduce__. torch.load(path, weights_only=False)
unpickles normally and runs the constructor.
Reproduce
pip install torch modelscan
modelscan -p poc_legacy.pt # No issues found!
python3 -c "import torch; torch.load('poc_legacy.pt', weights_only=False)"
ls /tmp/PWNED_BY_PT_LEGACY # sentinel file written
Disclosed via huntr.com.
- Created
- Apr 30, 2026
- Updated
- Apr 30, 2026