---
license: other
tags: [security-research, mfv, scanner-bypass, avro]
---
# Apache Avro (.avro) MFV PoC — Authorized Security Research

Authorization: huntr.com / Protect AI MFV bug bounty program.
All work local in a Python venv. Responsible disclosure only. Human-submitted.

## Summary

Format: Apache Avro (`.avro`)
Bypass: picklescan 1.0.4 + modelscan 0.8.8
Modes bypassed: all 4 (direct + directory scan for both scanners)
RCE via: `joblib.load('malicious.avro')`
Technique: bzip2-compressed joblib payload
Tested: 2026-06-25

## Files

- `malicious.avro` — bzip2-compressed joblib payload with .avro extension
- `poc-avro.py` — reproduction script
- `README.md` — this file

## Reproduction

```bash
pip install picklescan modelscan joblib

python3 poc-avro.py

picklescan -p malicious.avro
picklescan -p .
modelscan  -p malicious.avro
modelscan  -p .

python3 -c "
import joblib
print('--- BEFORE LOAD ---')
joblib.load('malicious.avro')
print('--- AFTER LOAD ---')
"
```