modelscan
keras-modelscan-bypass-poc
Keras ModelScan Bypass PoC
ModelScan 0.8.8 does not scan Lambda layers nested inside sub-models.
Result: zero-issue scan + RCE on keras.saving.load_model(..., safe_mode=False).
Run python reproduce.py to verify.
npz-modelscan-bypass-pocmodelscan-urllib3-bypass-pocpoc-modelscan-importlib-bypass
PoC: ModelScan Blocklist Bypass via importlib.import_module
Target: protectai/modelscan
CWE: CWE-693 (Protection Mechanism Failure)
Vulnerability
ModelScan's pickle scanner maintains a blocklist of 21 dangerous modules (os, subprocess, shutil, etc.). However, importlib is not on the blocklist. A pickle using importlib.import_module('os') bypasses all scanning and returns the full os module, enabling arbitrary code execution.
The bypass defeats the entire blocklist — all… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-modelscan-importlib-bypass.