{"record":{"id":"3683b240489334f3","repo":"invoke-ai/InvokeAI","slug":"the-model-path-stem-is-potentially-infected-by-m","errorCode":null,"errorMessage":"The model {path.stem} is potentially infected by malware. Aborting import.","messagePattern":"The model (.+?) is potentially infected by malware\\. Aborting import\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"invokeai/backend/model_manager/model_on_disk.py","lineNumber":127,"sourceCode":"        if path in self._state_dict_cache:\n            return self._state_dict_cache[path]\n\n        path = self.resolve_weight_file(path)\n\n        if path in self._state_dict_cache:\n            return self._state_dict_cache[path]\n\n        with SilenceWarnings():\n            if path.suffix.endswith((\".ckpt\", \".pt\", \".pth\", \".bin\")):\n                scan_result = scan_file_path(path)\n                if scan_result.infected_files != 0:\n                    if get_config().unsafe_disable_picklescan:\n                        logger.warning(\n                            f\"The model {path.stem} is potentially infected by malware, but picklescan is disabled. \"\n                            \"Proceeding with caution.\"\n                        )\n                    else:\n                        raise RuntimeError(\n                            f\"The model {path.stem} is potentially infected by malware. Aborting import.\"\n                        )\n                if scan_result.scan_err:\n                    if get_config().unsafe_disable_picklescan:\n                        logger.warning(\n                            f\"Error scanning the model at {path.stem} for malware, but picklescan is disabled. \"\n                            \"Proceeding with caution.\"\n                        )\n                    else:\n                        raise RuntimeError(f\"Error scanning the model at {path.stem} for malware. Aborting import.\")\n                checkpoint = torch.load(path, map_location=\"cpu\")\n                assert isinstance(checkpoint, dict)\n            elif path.suffix.endswith(\".gguf\"):\n                checkpoint = gguf_sd_loader(path, compute_dtype=torch.float32)\n            elif path.suffix.endswith(\".safetensors\"):\n                if _is_sdnq_safetensors(path):\n                    checkpoint = sdnq_sd_loader(path, compute_dtype=torch.float32)\n                else:","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/backend/model_manager/model_on_disk.py#L109-L145","documentation":"ModelOnDisk.load_state_dict runs picklescan on pickle-based checkpoint files (.pt/.pth/.ckpt/.bin) before torch.load. If the scan flags the file as malicious (dangerous globals like exec/eval/os.system), it aborts with this RuntimeError unless unsafe_disable_picklescan is set in the config. This protects users from arbitrary code execution hidden in model pickles.","triggerScenarios":"Loading a .ckpt/.pt/.pth/.bin file whose picklescan scan_result.issues are non-empty, with unsafe_disable_picklescan=False (the default), through from_state_dict, load_xlabs_state_dict, load_bnb4bit_state_dict, load_fp8_state_dict, or the ModelOnDisk constructor.","commonSituations":"Downloading community checkpoints from untrusted sources (Civitai, random HF repos); legacy .ckpt Stable Diffusion files known to contain pickle payloads; false positives on training checkpoints that legitimately pickle optimizers/lambdas.","solutions":["Do not import the file; obtain the same weights as a safetensors file, which cannot execute pickled code.","If you fully trust the source, temporarily set unsafe_disable_picklescan=true in invokeai.yaml and restart, then re-scan it offline.","Run picklescan yourself (picklescan --path file.ckpt) to inspect exactly which globals were flagged.","Convert the checkpoint to safetensors in a sandboxed environment, then import the converted file with scanning enabled.","Verify the file's hash against a known-good published checksum."],"exampleFix":"// before\n# invokeai.yaml\n# unsafe_disable_picklescan: true   # set blindly\n// after\n# instead: convert once in a sandbox\npython -c \"import torch; sd=torch.load('model.ckpt',map_location='cpu'); from safetensors.torch import save_file; save_file({k:v for k,v in sd.items() if hasattr(v,'dtype')},'model.safetensors')\"\n# then import model.safetensors with picklescan enabled","handlingStrategy":"validation","validationCode":"from picklescan import scan_file_path\nresult = scan_file_path(checkpoint_path)\nif result.issues:\n    raise RuntimeError(f'{checkpoint_path} flagged by picklescan; refusing to import')","typeGuard":null,"tryCatchPattern":"try:\n    sd = model_on_disk.load_state_dict(path)\nexcept RuntimeError as e:\n    if 'potentially infected by malware' in str(e):\n        logger.error(f'{path} failed picklescan. Get safetensors weights or vet the file manually.')\n    raise","preventionTips":["Prefer safetensors/gguf weights which cannot execute pickled code","Only download checkpoints from trusted publishers; verify published hashes","Never enable unsafe_disable_picklescan for untrusted community files","Scan suspicious files with `picklescan --path` in a sandbox before deciding"],"tags":["security","malware","picklescan","pickle","model-loading"],"backgroundTag":"pickle-malware-detected","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}