picklescan .mar bypass PoC

picklescan 1.0.4 does not scan .mar files at all. Directory scan returns "Scanned files: 0" on a directory that only contains .mar archives. modelscan handles these correctly by treating them as ZIP containers.

Files

malicious_model.mar -- TorchServe model archive (ZIP format) with a pickle payload inside model.pkl

Reproducing

pip install picklescan modelscan
picklescan -p .        # Scanned files: 0  <-- the bug
modelscan -p .         # flags CRITICAL    <-- correct behavior

Background

.mar is the only supported deployment format for TorchServe. It is a ZIP file containing model weights (.pt or .pkl), a handler script, and a MANIFEST.json. picklescan's extension filter covers .zip/.npz/.7z but not .mar, so it never opens the archive.

Submitted to huntr MFV program for responsible disclosure.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support