vetkit.py.deserialization.pickle-opt-in
A loader is explicitly told to accept pickled objects (weights_only=False, allow_pickle=True, safe_mode=False). A malicious file executes code when loaded.
Last updated:
Suite: Security
python
A loader is explicitly told to accept pickled objects (weights_only=False, allow_pickle=True, safe_mode=False). A malicious file executes code when loaded.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Keep the safe default (torch.load(weights_only=True), numpy allow_pickle=False, Keras safe_mode=True) or load only files whose integrity you verify.
References
Source: packages/engine/rules/sast/python.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.