{"record":{"id":"3120ed988fa98408","repo":"huggingface/smolagents","slug":"pickle-data-rejected-allow-pickle-false-requires-3120ed","errorCode":null,"errorMessage":"Pickle data rejected: allow_pickle=False requires safe-only data. This data appears to be pickle-serialized (legacy format). To deserialize it, set allow_pickle=True (not recommended for untrusted data).","messagePattern":"Pickle data rejected: allow_pickle=False requires safe-only data\\. This data appears to be pickle-serialized \\(legacy format\\)\\. To deserialize it, set allow_pickle=True \\(not recommended for untrusted data\\)\\.","errorType":"exception","errorClass":"SerializationError","httpStatus":null,"severity":"error","filePath":"src/smolagents/serialization.py","lineNumber":333,"sourceCode":"            if not allow_pickle:\n                raise SerializationError(\n                    \"Pickle data rejected: allow_pickle=False requires safe-only data. \"\n                    \"This data is pickle-serialized. To deserialize it, set \"\n                    \"allow_pickle=True (not recommended for untrusted data).\"\n                )\n            # Warn about insecure pickle deserialization\n            import warnings\n\n            warnings.warn(\n                \"Deserializing pickle data. This is a security risk if the data is untrusted.\",\n                FutureWarning,\n                stacklevel=2,\n            )\n            return pickle.loads(base64.b64decode(data[7:]))\n        else:\n            # No prefix - legacy format, assume pickle\n            if not allow_pickle:\n                raise SerializationError(\n                    \"Pickle data rejected: allow_pickle=False requires safe-only data. \"\n                    \"This data appears to be pickle-serialized (legacy format). To deserialize it, set \"\n                    \"allow_pickle=True (not recommended for untrusted data).\"\n                )\n            # Warn about insecure pickle deserialization\n            import warnings\n\n            warnings.warn(\n                \"Deserializing pickle data. This is a security risk if the data is untrusted.\",\n                FutureWarning,\n                stacklevel=2,\n            )\n            return pickle.loads(base64.b64decode(data))\n\n    @staticmethod\n    def _extract_method_body(method) -> str:\n        \"\"\"Extract method body without the def line and dedent it.\"\"\"\n        import inspect","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/huggingface/smolagents/blob/30bb1161095dbae2271e6bc3cc4c219cc3897a57/src/smolagents/serialization.py#L315-L351","documentation":"SafeSerializer.loads received a string with no recognized prefix, so it assumes the legacy format (raw base64 pickle). Because allow_pickle defaults to False, it refuses to deserialize what is probably pickle data for security reasons. This typically occurs with data serialized before the prefix scheme (safe JSON vs 'pickle:') was introduced.","triggerScenarios":"Calling loads on legacy persisted data (base64 pickle with no prefix) with allow_pickle=False, e.g. old saved agent traces loaded through convert, _get_metadata, get_tasks_to_run, or answer_questions.","commonSituations":"Upgrading smolagents and loading session files or cached metadata written by an older version; reading externally produced base64(pickle) blobs that lack the new prefix; strings that coincidentally aren't prefixed serialized data at all.","solutions":["If trusted, pass allow_pickle=True to loads","Verify the data actually is legacy pickle (try base64-decoding and pickle.loads in a sandbox); if it is arbitrary text, fix the caller passing the wrong string","Re-serialize the artifacts in the new prefixed safe format and update storage"],"exampleFix":"# before\nobj = SafeSerializer.loads(legacy_data)  # raises: legacy pickle suspected\n\n# after\nobj = SafeSerializer.loads(legacy_data, allow_pickle=True)  # trusted data only","handlingStrategy":"validation","validationCode":"def classify(data: str) -> str:\n    if data.startswith(SafeSerializer.SAFE_PREFIX): return \"safe\"\n    if data.startswith(\"pickle:\"): return \"pickle\"\n    return \"legacy-unknown\"  # inspect before enabling allow_pickle","typeGuard":"def looks_like_base64_pickle(data: str) -> bool:\n    import base64\n    try:\n        base64.b64decode(data, validate=True)\n        return True\n    except Exception:\n        return False","tryCatchPattern":"from smolagents.serialization import SerializationError\ntry:\n    obj = SafeSerializer.loads(data)\nexcept SerializationError:\n    obj = SafeSerializer.loads(data, allow_pickle=True)  # only after verifying provenance","preventionTips":["Migrate legacy artifacts to the prefixed safe format once, then keep allow_pickle=False","Record a format version alongside persisted data","Never enable allow_pickle for data received over network or from users"],"tags":["serialization","pickle","legacy-migration","security"],"backgroundTag":"insecure-pickle-deserialization","analyzedSha":"30bb1161095dbae2271e6bc3cc4c219cc3897a57","analyzedAt":"2026-08-28T18:52:54.169Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}