Executive brief
PickleScan is a security tool that scans PyTorch model files for embedded malicious code. An attacker can bypass PickleScan's detection by modifying specific bits in the ZIP file headers of a PyTorch model archive, allowing malicious pickle files to remain hidden while still executing when the model is loaded by PyTorch. This could enable distribution of backdoored AI models via public repositories.
Technical details
This vulnerability is a detection evasion issue (CWE-345) in PickleScan's ZIP file handling. The root cause is that PickleScan relies on Python's zipfile module to extract and scan files, but by flipping specific flag bits (e.g., 0x1, 0x20, 0x40) in ZIP file headers, an attacker can cause PickleScan to raise exceptions and skip scanning while PyTorch's torch.load() ignores the flag modifications and successfully loads the model. The attack is network-based, requiring no authentication or special privileges, though it does require the victim to load a compromised model file. An attacker can achieve arbitrary code execution through embedded pickle payloads. The vulnerability affects all versions of PickleScan before 0.0.23, which includes the fix.
Affected products
- PickleScan PickleScan < 0.0.23
Timeline
- 2025-03-09: disclosed
- 2025-03-09: patched: Fixed in version 0.0.23
- 2025-03-10: advisory