---
tags:
- modelscan-bypass
- security-research
---
# ModelScan Bypass PoC — Joblib Format (cProfile.run)

## Summary
This repository demonstrates a bypass of ProtectAI's modelscan scanner using the `cProfile.run()` technique in Joblib format.

## Vulnerability
- **Scanner**: modelscan v0.7.6 (latest as of 2026-04-06)
- **Format**: Joblib (.joblib) — listed as premium format on Huntr MFV
- **Technique**: `cProfile.run(stmt)` internally calls `exec(stmt)`, achieving full RCE
- **Blocklist gap**: Neither `cProfile` module nor its `run` function appear in modelscan's `unsafe_globals`
- **Scan result**: 0 issues found

## Impact
An attacker can upload a malicious .joblib model file to any model registry. When a victim loads it with `joblib.load()` or `pickle.load()`, arbitrary code executes.

## Reproduction
```bash
# Scan with modelscan — reports 0 issues
modelscan scan -p model.joblib

# Load to trigger RCE
python3 -c "import joblib; joblib.load('model.joblib')"
# Creates /tmp/joblib_pwned.txt with proof of execution
```

## Technical Details
The pickle bytecode uses:
1. `STACK_GLOBAL` to resolve `cProfile.run`
2. `REDUCE` to call it with an arbitrary Python statement
3. `cProfile.run()` internally calls `exec(compile(stmt))`, executing arbitrary code

This is the same technique as the pickle bypass but targeting the Joblib format specifically, which is listed as a separate premium format on the Huntr MFV bounty program.