---
license: mit
tags:
- security-research
- modelscan-bypass
---

# modelscan-bypass-importlib-shutil

## Security Research — Modelscan Bypass PoC

**Severity**: HIGH

**Module**: `importlib + operator.methodcaller → shutil`

**Description**: File operations via importlib.import_module("shutil") + methodcaller

**Impact**: Bypasses shutil.* blocklist. Can copy/move/delete files. shutil.rmtree for recursive deletion.

## Modelscan Result

```
$ modelscan scan -p pytorch_model.bin
No issues found! ✅ (FALSE NEGATIVE)
```

**Tested against**: modelscan 0.8.8 (latest)

## How It Works

The pickle file uses `importlib + operator.methodcaller → shutil` which is NOT in modelscan's unsafe_globals blocklist.
When loaded via `torch.load()` or `pickle.loads()`, it executes the payload.

## Responsible Disclosure

This PoC is part of responsible security research submitted via Huntr MFV program
to help ProtectAI improve modelscan's detection capabilities.