PickleScan crashes on manipulated ZIP archives while PyTorch loads them
PickleScan versions before 0.0.23 crash when scanning PyTorch model archives with manipulated ZIP headers, while PyTorch continues to load them, potentially allowing attackers to bypass malware detection in supply chain attacks.
What happened
PickleScan versions before 0.0.23 are vulnerable to a ZIP archive manipulation attack where an attacker modifies the filename in a ZIP header while keeping the original filename in the directory listing.
When PickleScan attempts to extract and scan PyTorch model archives with this manipulation, Python's strict zipfile module raises a BadZipFile error, causing PickleScan to crash.
PyTorch's more tolerant ZIP implementation ignores the header discrepancy and allows the model to load successfully, enabling malicious payloads embedded in the archive to bypass PickleScan's detection.
Reported impact
Attackers can embed malicious payloads inside PyTorch model archives while preventing PickleScan from scanning them.
This technique can be used in supply chain attacks to distribute backdoored models via platforms like Hugging Face.
Index analysis
Python's built-in zipfile module performs strict integrity checks when extracting ZIP files, raising BadZipFile errors when filenames in the ZIP header do not match the directory listing.
PickleScan relies on zipfile to extract and inspect PyTorch model archives, making it susceptible to this manipulation.
Governance controls
PickleScan version 0.0.23 contains a fix for this issue.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.