Downloads · 30 days
0
modelscan-bypass-ctypes-getitem
xiaoyaoes/modelscan-bypass-ctypes-getitem
modelscan-bypass-ctypes-getitem is a machine learning model from xiaoyaoes. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as mit.
PoC: Bypassing modelscan (protectai/modelscan) pickle scanner via ctypes.CDLL + operator.getitem.
Access
Public
Updated Jun 20, 2026
Repo size
130 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 62%
At a glance
- License
- mit
- Access
- Public
- Created
- Jun 20, 2026
- Updated
- Jun 20, 2026
- SHA
- 168aa7ae
Model card
From the Hugging Face model README
modelscan-bypass-ctypes-getitem
PoC: Bypassing modelscan (protectai/modelscan) pickle scanner via ctypes.CDLL + operator.getitem.
Technique
Instead of using Python-level exec/eval (which modelscan blocks), this approach:
- Uses
ctypes.CDLL('libc.so.6')to load the C standard library - Accesses
libc.system()viaoperator.getitem(libc, 'system')(uses__getitem__, not blocked) - Calls
system(b'cmd')for arbitrary shell execution
Impact
- CVSS 9.8 — Remote Code Execution via malicious pickle file
- modelscan <= 0.8.8 completely undetectable
- Root cause: ctypes module entirely missing from blocklist; operator.getitem not covered
PoC File
ctypes_bypass.pkl — 130-byte pickle payload that executes arbitrary shell commands.
- License
- mit
- Created
- Jun 20, 2026
- Updated
- Jun 20, 2026