Using pty.spawn, which is a built-in python library function to execute arbitrary commands on the host system.

The attack payload executes in the following steps: First, the attacker craft the payload by calling to pty.spawn function in the reduce method. Then the victim attempts to use picklescan to scan the pickle file for issues and sees this -

----------- SCAN SUMMARY -----------
Scanned files: 1
Infected files: 0
Dangerous globals: 0

The victim proceeds to load the pickle file and execute attacker-injected arbitrary code.

class PtyExploit:
 def  reduce (self):
  return (pty.spawn, (["/bin/sh", "-c", "id; exit"],))

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

https://github.com/ajohnston9 https://github.com/geo-lit