{"record":{"id":"4baae1b61487d0ad","repo":"huggingface/smolagents","slug":"deserializing-pickle-data-this-is-a-security-risk","errorCode":null,"errorMessage":"Deserializing pickle data. This is a security risk if the data is untrusted.","messagePattern":"Deserializing pickle data\\. This is a security risk if the data is untrusted\\.","errorType":"console","errorClass":"FutureWarning","httpStatus":null,"severity":"warning","filePath":"src/smolagents/serialization.py","lineNumber":324,"sourceCode":"\n        Raises:\n            SerializationError: If pickle data received but allow_pickle=False\n        \"\"\"\n        if data.startswith(SafeSerializer.SAFE_PREFIX):\n            json_data = json.loads(data[len(SafeSerializer.SAFE_PREFIX) :])\n            return SafeSerializer.from_json_safe(json_data)\n        elif data.startswith(\"pickle:\"):\n            # Explicit pickle prefix\n            if not allow_pickle:\n                raise SerializationError(\n                    \"Pickle data rejected: allow_pickle=False requires safe-only data. \"\n                    \"This data is pickle-serialized. To deserialize it, set \"\n                    \"allow_pickle=True (not recommended for untrusted data).\"\n                )\n            # Warn about insecure pickle deserialization\n            import warnings\n\n            warnings.warn(\n                \"Deserializing pickle data. This is a security risk if the data is untrusted.\",\n                FutureWarning,\n                stacklevel=2,\n            )\n            return pickle.loads(base64.b64decode(data[7:]))\n        else:\n            # No prefix - legacy format, assume pickle\n            if not allow_pickle:\n                raise SerializationError(\n                    \"Pickle data rejected: allow_pickle=False requires safe-only data. \"\n                    \"This data appears to be pickle-serialized (legacy format). To deserialize it, set \"\n                    \"allow_pickle=True (not recommended for untrusted data).\"\n                )\n            # Warn about insecure pickle deserialization\n            import warnings\n\n            warnings.warn(\n                \"Deserializing pickle data. This is a security risk if the data is untrusted.\",","sourceCodeStart":306,"sourceCodeEnd":342,"githubUrl":"https://github.com/huggingface/smolagents/blob/30bb1161095dbae2271e6bc3cc4c219cc3897a57/src/smolagents/serialization.py#L306-L342","documentation":"serialization.loads warns with this FutureWarning whenever it encounters the pickle-safe prefix and deserializes via pickle.loads (data created by the pickle fallback path, with allow_pickle=True). The warning flags the security risk of unpickling, since malicious payloads can execute arbitrary code.","triggerScenarios":"Loading serialized smolagents state that contains any object outside the safe-type set; round-tripping dumps()->loads() where the dumps side already fell back to pickle.","commonSituations":"Restoring saved agents/memories from disk or across services; CI with warnings-as-errors failing on the FutureWarning; consuming serialized data from untrusted sources (dangerous).","solutions":["Eliminate pickle-producing objects at the dumps side (use safe types) so loads never hits the pickle branch","Only set allow_pickle=True for data you produced yourself; never for untrusted input","Filter FutureWarning if the data is trusted and you accept the risk temporarily","Long term, remove pickle fallback usage before smolagents deletes it"],"exampleFix":"# before\ndata = dumps({'obj': CustomObject()})\nres = loads(data, allow_pickle=True)  # warns\n\n# after\ndata = dumps({'obj': {'x': 1}})  # safe types only\nres = loads(data)  # no warning, no pickle","handlingStrategy":"validation","validationCode":"from smolagents.serialization import SafeSerializer\ndef safe_loads(data: str):\n    if data.startswith(SafeSerializer.SAFE_PREFIX if hasattr(SafeSerializer, 'SAFE_PREFIX') else 'PICKLE::'):\n        raise ValueError('refusing to unpickle untrusted data')\n    return loads(data)","typeGuard":"def is_pickle_payload(data: str) -> bool:\n    return not data.startswith('{') and '|' in data and data.split('|')[0] not in ('json',)  # adjust to actual prefix","tryCatchPattern":"try:\n    obj = loads(data)\nexcept Exception:\n    raise ValueError('serialized data unreadable; regenerate from safe types')","preventionTips":["Never unpickle data from untrusted sources","Serialize only safe types so the pickle branch is never hit","Filter FutureWarning only for data you generated yourself"],"tags":["smolagents","serialization","pickle","security","deserialization"],"backgroundTag":"unsafe-pickle-serialization","analyzedSha":"30bb1161095dbae2271e6bc3cc4c219cc3897a57","analyzedAt":"2026-08-28T18:52:54.169Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}