---
tags:
  - security
  - proof-of-concept
  - joblib
  - modelscan
  - picklescan
license: mit
---

# Joblib loky `spawnv_passfds` ACE PoC

This repository contains a bounded security research PoC for a scanner-clean
`.joblib` artifact that invokes
`joblib.externals.loky.backend.resource_tracker.spawnv_passfds` during
`joblib.load()`.

## Files

- `control_plain_dict.joblib` - benign control artifact.
- `malicious_loky_spawnv_passfds.joblib` - spawns the current Python
  interpreter and writes a marker file in the reproduction temp directory.
- `reproduce.py` - loads each artifact and waits on the returned child PID.
- `requirements.txt` - tested dependencies.

Exact public file URLs:

- `https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/control_plain_dict.joblib`
- `https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/malicious_loky_spawnv_passfds.joblib`
- `https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/reproduce.py`
- `https://huggingface.co/hacnho/joblib-loky-spawnv-passfds-ace-poc/resolve/main/requirements.txt`

## Tested Environment

- `joblib==1.5.3`
- `picklescan==1.0.4`
- `modelscan==0.8.8`

## Reproduction

```bash
python3 -m venv /tmp/joblib-spawnv-poc
/tmp/joblib-spawnv-poc/bin/pip install -U pip
/tmp/joblib-spawnv-poc/bin/pip install -r requirements.txt
/tmp/joblib-spawnv-poc/bin/python reproduce.py *.joblib
```

Expected marker for the malicious artifact:

```text
mfv_loky_spawnv_passfds_marker.txt
```

Scanner results:

- `picklescan==1.0.4`: `infected_files = 0`, `issues_count = 0`.
- `modelscan==0.8.8`: `No issues found!`.