celvexgroup/modelaudit-mlflow-models-from-code-poc

PoC - modelaudit clean-passes MLflow models-from-code load-time RCE (BL-0109)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.

• Scanner: modelaudit==0.2.49 (+ modelscan==0.8.8). Format: MLflow (models-from-code).
• modelaudit scan evil_mfc_model/ -> 'Clean' / NO ISSUES FOUND / exit 0, but mlflow.pyfunc.load_model('evil_mfc_model') imports+executes evil_script.py at load time (RCE). MLflow models-from-code persists a model as a plain .py entrypoint + an MLmodel YAML manifest with NO pickle; modelaudit classifies the .py (and the MLmodel) as 'unknown format' and skips them (core.py:7005-7008), and never follows the manifest's model_code_path. benign_mfc_model/ is the same shape with no payload (also Clean = the miss is genuine); pickle_positive_control/model.pkl fires CRITICAL (posix.system), proving the detector is live.
• Benign: evil_script.py only os.system('touch

Files: evil_mfc_model/ (MLmodel + evil_script.py; scans Clean, RCE on load), benign_mfc_model/ (control), pickle_positive_control/model.pkl (fires). Full report in huntr submission.