Downloads · 30 days
0
mfv-joblib-zf-bypass
xiaoyaoes/mfv-joblib-zf-bypass
mfv-joblib-zf-bypass is a machine learning model from xiaoyaoes. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as mit.
Scanner Bypass via Joblib ZF Compat Mode + NDArrayWrapper + np.load(allowpickle=True)
Access
Public
Updated Jun 20, 2026
Repo size
486 B
Likes
1
Public
Repo makeup
Click a slice to open those files.
.md1.9 KB · 39%
At a glance
- License
- mit
- Access
- Public
- Created
- Jun 20, 2026
- Updated
- Jun 20, 2026
- SHA
- 2ccc9936
Base models
Model card
From the Hugging Face model README
Joblib ZF Compat + Companion .npy Scanner Bypass
Vulnerability
Scanner Bypass via Joblib ZF Compat Mode + NDArrayWrapper + np.load(allow_pickle=True)
ProtectAI ModelScan 0.8.8 and PickleScan 1.0.4 both fail to detect malicious code embedded in joblib model files that use the ZF compat format (joblib ≤0.9.3 compatibility) with a companion .npy file.
Attack Chain
model.joblib— Uses ZF format (prefixZF+ zlib compressed pickle). Scanners attempt to parse as raw pickle, fail on unknown opcodeZ, and report "0 dangerous globals".- Inside the ZF payload:
NDArrayWrapper("payload.npy", np.ndarray)— This is a legacy joblib class that loads tensor data from a separate .npy file. payload.npy— A numpy NPY file containing an object-dtype array with a malicious pickle payload.- When
joblib.load('model.joblib')is called: ZF→zlib decompress→unpickle NDArrayWrapper→np.load('payload.npy', allow_pickle=True)→RCE
Scanner Results
| Scanner | model.joblib | payload.npy | Result |
|---|---|---|---|
| ModelScan 0.8.8 | ❌ Parsing error: opcode 'Z' unknown | ❌ numpy._check_version error | Bypassed |
| PickleScan 1.0.4 | ❌ opcode 'Z' unknown | Scans .npy as pickle → detects | Bypassed (if .npy not scanned) |
In practice, scanners only check .joblib and .pkl files, not companion .npy files.
Novelty
This is a third distinct bypass technique for joblib, different from:
- Compression bypass (zlib/zstd/bz2/lzma wrapping)
- Hybrid object-dtype array embedding
- ZF compat mode + companion .npy ← this work
Usage
python3 poc_verify.py
# Output: RCE triggered via np.load(allow_pickle=True)
- License
- mit
- Created
- Jun 20, 2026
- Updated
- Jun 20, 2026