vellaveto/joblib-scanner-bypass-poc

Joblib Scanner Bypass PoC — Security Research Artifacts

WARNING: These files are intentionally malicious model files created for authorized security research. DO NOT load them with `joblib.load()` outside of a sandboxed environment. They execute arbitrary code.

Purpose

These 6 .joblib files demonstrate that existing model file scanners (picklescan, modelscan) fail to detect malicious payloads in Joblib model files. This is a responsible disclosure artifact for the huntr MFV program.

Scanner Evasion Results (2026-03-20)

modelscan misses 5/6 compressed payloads. picklescan reports "0 dangerous globals" on all compressed variants (false negative).

Files

• —payload1_zlib_rce.joblib — Standard __reduce__ RCE, zlib compressed. Scanners must decompress to detect.
• —payload2_lzma_rce.joblib — Same payload, LZMA compression. Scanners expecting zlib miss this.
• —payload3_hidden_in_numpy.joblib — RCE object hidden inside numpy.ndarray(dtype=object) within a dict that mimics an sklearn model (weights, biases, metadata).
• —payload4_uncompressed.joblib — No compression. Control sample — scanners should catch this.
• —payload5_exfil_secrets.joblib — Exfiltrates environment variables matching KEY/SECRET/TOKEN/PASS patterns.
• —payload6_fake_pipeline.joblib — Payload disguised as sklearn Pipeline with a StandardScaler-like class that has legitimate mean_/scale_ attributes.

How They Work

All payloads use Python pickle's __reduce__ protocol to execute code when deserialized:

class Evil:
    def __reduce__(self):
        return (eval, ("__import__('os').popen('id').read()",))

joblib.dump(Evil(), "payload.joblib", compress=('zlib', 9))
# Loading this file executes 'id' on the host:
result = joblib.load("payload.joblib")  # → "uid=1000(user) ..."

The evasion comes from Joblib's compression layer (zlib/LZMA) which transforms pickle opcodes into opaque binary, and from nesting payloads inside legitimate-looking numpy arrays.

Responsible Disclosure

• —Disclosed to: huntr MFV program
• —Affected: Any system that loads .joblib files from untrusted sources
• —Scanners affected: modelscan 0.8.8, picklescan 1.0.4
• —Researcher: vellaveto

Do Not Use Maliciously

These artifacts exist solely to improve model file security scanning. Using them against systems without authorization is illegal.