Downloads · 30 days
0
mfv-sklearn-sav-poc
zamaanahmed/mfv-sklearn-sav-poc
mfv-sklearn-sav-poc is a machine learning model from zamaanahmed. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as other.
Both picklescan 1.0.4 and modelscan 0.8.8 skip .sav files entirely. This extension is widely used to save scikit-learn/joblib models and is byte-for-byte identical to .pkl. Neither scanner warns the user.
Access
Public
Updated Jun 19, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 58%
At a glance
- License
- other
- Access
- Public
- Created
- Jun 19, 2026
- Updated
- Jun 19, 2026
- SHA
- be13e125
Model card
From the Hugging Face model README
picklescan + modelscan .sav bypass PoC
Both picklescan 1.0.4 and modelscan 0.8.8 skip .sav files entirely. This extension is widely used to save scikit-learn/joblib models and is byte-for-byte identical to .pkl. Neither scanner warns the user.
Files
- malicious_model.sav -- joblib-serialized pickle file with a payload, saved as .sav
Reproducing
pip install picklescan modelscan scikit-learn joblib
picklescan -p . # Scanned files: 0
modelscan -p . # No issues found
python3 -c "import joblib; joblib.load('malicious_model.sav')"
Background
.sav is a common convention for sklearn model files -- used in Microsoft Azure ML docs and thousands of public repos. The files are plain pickle (same magic bytes as .pkl). The extension filter in both scanners does not include .sav so the files are silently skipped.
Submitted to huntr MFV program for responsible disclosure.
- License
- other
- Created
- Jun 19, 2026
- Updated
- Jun 19, 2026