---
tags:
- security-research
- modelscan-bypass
---

# modelscan Bypass: sqlite3 Database-Mediated File Write + Native Code RCE

## Security Research — Responsible Disclosure

This repository contains proof-of-concept pickle files demonstrating that modelscan v0.8.8 
fails to detect malicious payloads using `sqlite3.connect()` + `operator.methodcaller()`.

### Files
- `sqlite3_attach_bypass.pkl` — Arbitrary file creation via ATTACH DATABASE (guaranteed to work)
- `sqlite3_rce_bypass.pkl` — Native code execution via load_extension (requires extension-enabled Python)

### Attack Category
**Database-mediated arbitrary file write + native code RCE** — novel bypass class.

### Scanner Result
```
modelscan scan -p sqlite3_attach_bypass.pkl
No issues found! 🎉
```

### Root Cause
`sqlite3` module is completely absent from modelscan's `unsafe_globals` blocklist.
`operator.methodcaller` is also not blocked (only `attrgetter` is listed).

### Impact
- Arbitrary file creation at any writable path
- Attacker-controlled data injection into files
- Native shared library loading (full RCE) via load_extension
- Two-stage chain: combine with _io/pathlib bypass to write .so, then load via sqlite3