metadata
library_name: pytorch
tags:
- security-research
- modelscan-bypass
license: mit
ModelScan Bypass PoC — builtins.type
Security research for responsible disclosure via Huntr MFV program.
Vulnerability
builtins.type is not in modelscan's unsafe_globals blocklist.
When a pickle file containing this global is scanned by modelscan, it reports "No issues found."
However, loading the file with pickle.loads() / torch.load() triggers arbitrary class construction — enables metaclass chains and typing.get_type_hints eval() RCE.
Impact
- Severity: HIGH
- Effect: arbitrary class construction — enables metaclass chains and typing.get_type_hints eval() RCE
Bypass Class
modelscan blocks builtins.eval, builtins.exec, builtins.getattr, etc. but does NOT block builtins.type. type(name, bases, dict) constructs arbitrary classes, which can then be fed to typing.get_type_hints for eval()-based RCE.
Reproduction
pip install modelscan
modelscan scan -p bypass_poc.pkl
# Output: "No issues found!"