Python trust_remote_code=True runs Hub repository code
Rule ID: vetkit.py.supply-chain.trust-remote-code
A model, tokenizer, pipeline or dataset is loaded with trust_remote_code=True. The Hub repository's own Python code is downloaded and executed on load, so whoever controls (or hijacks) that repository runs code on this machine; an unpinned revision lets the code change at any time.
Last updated:
Suite: Security
python
A model, tokenizer, pipeline or dataset is loaded with trust_remote_code=True. The Hub repository's own Python code is downloaded and executed on load, so whoever controls (or hijacks) that repository runs code on this machine; an unpinned revision lets the code change at any time.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Prefer a model with native library support so the flag is not needed. If remote code is unavoidable, pin revision= to a commit hash you have reviewed, load from a vetted internal mirror, and run the loading process in an isolated environment without credentials.
References
Source: packages/engine/rules/sast/python.yml.
Related checks
- Python pip install at runtime bypasses the lockfile
- Python assert used for authorization is removed by -O
- Python hardcoded password or API key compared to literal
- Python cleartext FTP or Telnet connection (ftplib, telnetlib)
- Python cloud SDK client with hardcoded secret access key
- Python eval() and exec() with non-literal argument
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.