title: Joblib Legacy Companion Path Scanner Bypass PoC
license: apache-2.0

Joblib Legacy Companion Path Traversal / Scanner Bypass PoC

This is a harmless local-only PoC for a Huntr Model File Vulnerability report.

It demonstrates that current Joblib legacy NDArrayWrapper compatibility can load a companion .npy outside the primary model directory via ../payload.npy, then call np.load(..., allow_pickle=True) on that companion.

Files

• victim/model.joblib — small top-level legacy Joblib artifact referencing ../payload.npy.
• payload.npy — harmless NumPy object array companion payload.
• joblib_legacy_companion_scanner_bypass_poc.py — generator/reproducer script.
• local_repro_output.txt — local proof output from the generated artifacts.

Reproduce locally

python -m venv .venv
. .venv/bin/activate
pip install numpy cloudpickle joblib picklescan
python joblib_legacy_companion_scanner_bypass_poc.py --base /tmp/joblib-companion-poc

The PoC only creates a local marker file named MARKER_CREATED_BY_JOBLIB_LOAD.txt under the chosen base directory. It does not contact external services or execute destructive actions.

Expected key output

outer_contains_marker_callable=False
companion_contains_marker_callable=True
marker_exists_before_load=False
marker_exists_after_load=True
marker_contents='joblib legacy companion payload reached'

Scanner observation

Scanning the top-level victim/model.joblib or containing directory with picklescan 0.8.8 did not follow Joblib's legacy companion-file semantics, while direct scanning of payload.npy showed the harmless marker callable.