Downloads · 30 days
0
mfv-torchserve-mar-poc
zamaanahmed/mfv-torchserve-mar-poc
mfv-torchserve-mar-poc is a machine learning model from zamaanahmed. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as other.
picklescan 1.0.4 does not scan .mar files at all. Directory scan returns "Scanned files: 0" on a directory that only contains .mar archives. modelscan handles these correctly by treating them as ZIP containers.
Access
Public
Updated Jun 19, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
Other1.5 KB · 53%
At a glance
- License
- other
- Access
- Public
- Created
- Jun 19, 2026
- Updated
- Jun 19, 2026
- SHA
- 56e652fc
Model card
From the Hugging Face model README
picklescan .mar bypass PoC
picklescan 1.0.4 does not scan .mar files at all. Directory scan returns "Scanned files: 0" on a directory that only contains .mar archives. modelscan handles these correctly by treating them as ZIP containers.
Files
- malicious_model.mar -- TorchServe model archive (ZIP format) with a pickle payload inside model.pkl
Reproducing
pip install picklescan modelscan
picklescan -p . # Scanned files: 0 <-- the bug
modelscan -p . # flags CRITICAL <-- correct behavior
Background
.mar is the only supported deployment format for TorchServe. It is a ZIP file containing model weights (.pt or .pkl), a handler script, and a MANIFEST.json. picklescan's extension filter covers .zip/.npz/.7z but not .mar, so it never opens the archive.
Submitted to huntr MFV program for responsible disclosure.
- License
- other
- Created
- Jun 19, 2026
- Updated
- Jun 19, 2026