Modelpublic

celvexgroup/modelscan-nested-zip-archive-poc

sourceHugging Faceupdated 2mo agoView on Hugging Face

0likes

Model Card

PoC - modelscan nested-zip coverage bypass on PyTorch archives (BL-0107)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.

—Scanner: modelscan==0.8.8 (modelscan.py). Format: PyTorch Archive (.mar) / Torch Export (.pt2).
—modelscan -p evilmodel_zip.mar -> issues=[], 'No issues found', while torch.load / TorchServe loads the embedded zip-format .pt member and runs its _reduce_. modelscan recurses only one level: a member that is itself a zip is recorded as a non-fatal NestedZipError and skipped (modelscan.py:103-110). The identical inner pickle scanned at top level is flagged CRITICAL (posix.system) - so the nested 'clean' is a genuine miss.
—Benign: the embedded _reduce_ only touches a marker file. NOTE: modelscan prints 'does not support nested zip files' and exits 3 here; the security issue is that the issues array / summary that gate logic consumes shows the malicious .mar as clean.

Files: evilmodelzip.mar (.mar vector), evilsampleinput.pt2 (.pt2 vector). Full report in huntr submission.