---
license: mit
tags:
- security-research
- modelscan-bypass
---

# modelscan-bypass-importlib-subprocess

## Security Research — Modelscan Bypass PoC

**Severity**: CRITICAL

**Module**: `importlib + operator.methodcaller → subprocess`

**Description**: Full RCE via importlib.import_module("subprocess") + operator.methodcaller("getoutput", cmd)

**Impact**: Command execution via subprocess.getoutput(). Bypasses subprocess.* blocklist entry via importlib indirection.

## Modelscan Result

```
$ modelscan scan -p pytorch_model.bin
No issues found! ✅ (FALSE NEGATIVE)
```

**Tested against**: modelscan 0.8.8 (latest)

## How It Works

The pickle file uses `importlib + operator.methodcaller → subprocess` which is NOT in modelscan's unsafe_globals blocklist.
When loaded via `torch.load()` or `pickle.loads()`, it executes the payload.

## Responsible Disclosure

This PoC is part of responsible security research submitted via Huntr MFV program
to help ProtectAI improve modelscan's detection capabilities.