{"record":{"id":"0148374367b8c458","repo":"huggingface/smolagents","slug":"pickle-data-rejected-allow-pickle-false","errorCode":null,"errorMessage":"Pickle data rejected: allow_pickle=False","messagePattern":"Pickle data rejected: allow_pickle=False","errorType":"validation","errorClass":"SerializationError","httpStatus":null,"severity":"critical","filePath":"src/smolagents/remote_executors.py","lineNumber":329,"sourceCode":"        - \"safe:\" for JSON-safe payloads\n        - \"pickle:\" for pickle payloads (only when allow_pickle=True)\n\n        Args:\n            encoded_value (`str`): Serialized string from FinalAnswerException.\n            allow_pickle (`bool`, default `False`): Whether to allow pickle deserialization.\n\n        Returns:\n            `Any`: Deserialized Python object.\n\n        Raises:\n            SerializationError: If pickle data is rejected.\n        \"\"\"\n        if encoded_value.startswith(\"safe:\"):\n            json_data = json.loads(encoded_value[5:])\n            return SafeSerializer.from_json_safe(json_data)\n        elif encoded_value.startswith(\"pickle:\"):\n            if not allow_pickle:\n                raise SerializationError(\"Pickle data rejected: allow_pickle=False\")\n            return pickle.loads(base64.b64decode(encoded_value[7:]))\n        else:\n            raise SerializationError(\"Unknown final answer format: expected 'safe:' or 'pickle:' prefix\")\n\n\nclass E2BExecutor(RemotePythonExecutor):\n    \"\"\"\n    Remote Python code executor in an E2B sandbox.\n\n    Args:\n        additional_imports (`list[str]`): Additional Python packages to install.\n        logger (`Logger`): Logger to use for output and errors.\n        allow_pickle (`bool`, default `False`): Whether to allow pickle serialization for objects that cannot be safely serialized to JSON.\n            - `False` (default, recommended): Only safe JSON serialization is used. Raises error if object cannot be safely serialized.\n            - `True` (legacy mode): Tries safe JSON serialization first, falls back to pickle with warning if needed.\n\n            **Security Warning:** Pickle deserialization can execute arbitrary code. Only set `allow_pickle=True`\n            if you fully trust the execution environment and need backward compatibility with custom types.","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/huggingface/smolagents/blob/30bb1161095dbae2271e6bc3cc4c219cc3897a57/src/smolagents/remote_executors.py#L311-L347","documentation":"Raised when deserializing a final answer whose payload is prefixed 'pickle:' (produced by an executor running with allow_pickle=True) but the deserializing side has allow_pickle=False. This is a deliberate security guard: untrusted pickle payloads can execute arbitrary code.","triggerScenarios":"The remote executor serialized the answer with pickle, but _deserialize_final_answer is called with allow_pickle=False — e.g. mixing executor configurations, or a tampered/forged 'pickle:' payload.","commonSituations":"Sender and receiver disagree on allow_pickle; upgrading smolagents where pickle was previously the default; processing untrusted sandbox output.","solutions":["Align both sides: pass allow_pickle=True to the executor/deserializer if you trust the code producing the payload","Prefer safe mode everywhere (allow_pickle=False) and make executed code return JSON-safe types","Never enable pickle for untrusted or user-supplied code"],"exampleFix":"# before\nexecutor = DockerExecutor(allow_pickle=False)  # remote side used pickle\n\n# after\nexecutor = DockerExecutor(allow_pickle=True)  # only if payload is trusted","handlingStrategy":"validation","validationCode":"def payload_allowed(encoded: str, allow_pickle: bool) -> bool:\n    if encoded.startswith(\"safe:\"):\n        return True\n    return allow_pickle and encoded.startswith(\"pickle:\")","typeGuard":null,"tryCatchPattern":"from smolagents.remote_executors import SerializationError\n\ntry:\n    value = RemotePythonExecutor._deserialize_final_answer(encoded, allow_pickle)\nexcept SerializationError as e:\n    if \"allow_pickle\" in str(e):\n        raise RuntimeError(\"Remote side used pickle; align allow_pickle=True on both ends\") from e\n    raise","preventionTips":["Set the same allow_pickle value on all executors/deserializers","Default to safe mode and keep final answers JSON-friendly","Never pickle-deserialize untrusted sandbox output"],"tags":["pickle","deserialization","security","final-answer","allow-pickle"],"backgroundTag":"insecure-deserialization-blocked","analyzedSha":"30bb1161095dbae2271e6bc3cc4c219cc3897a57","analyzedAt":"2026-08-28T18:52:54.169Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}