{"record":{"id":"de1636a1e26a9d3e","repo":"invoke-ai/InvokeAI","slug":"the-model-path-is-potentially-infected-by-malwar","errorCode":null,"errorMessage":"The model {path} is potentially infected by malware. Aborting import.","messagePattern":"The model (.+?) is potentially infected by malware\\. Aborting import\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"invokeai/backend/model_manager/util/model_util.py","lineNumber":72,"sourceCode":"            path_str = path.as_posix() if isinstance(path, Path) else path\n            checkpoint = _fast_safetensors_reader(path_str)\n        except Exception:\n            # TODO: create issue for support \"meta\"?\n            checkpoint = safetensors.torch.load_file(path, device=\"cpu\")\n    elif str(path).endswith(\".gguf\"):\n        # The GGUF reader used here uses numpy memmap, so these tensors are not loaded into memory during this function\n        checkpoint = gguf_sd_loader(Path(path), compute_dtype=torch.float32)\n    else:\n        if scan:\n            scan_result = pscan.scan_file_path(path)\n            if scan_result.infected_files != 0:\n                if get_config().unsafe_disable_picklescan:\n                    logger.warning(\n                        f\"The model {path} is potentially infected by malware, but picklescan is disabled. \"\n                        \"Proceeding with caution.\"\n                    )\n                else:\n                    raise RuntimeError(f\"The model {path} is potentially infected by malware. Aborting import.\")\n            if scan_result.scan_err:\n                if get_config().unsafe_disable_picklescan:\n                    logger.warning(\n                        f\"Error scanning the model at {path} for malware, but picklescan is disabled. \"\n                        \"Proceeding with caution.\"\n                    )\n                else:\n                    raise RuntimeError(f\"Error scanning the model at {path} for malware. Aborting import.\")\n\n        checkpoint = torch.load(path, map_location=torch.device(\"meta\"))\n    return checkpoint\n\n\ndef lora_token_vector_length(checkpoint: dict[str | int, torch.Tensor]) -> Optional[int]:\n    \"\"\"\n    Given a checkpoint in memory, return the lora token vector length\n\n    :param checkpoint: The checkpoint","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/backend/model_manager/util/model_util.py#L54-L90","documentation":"read_checkpoint_meta() runs picklescan on pickle-based checkpoints (.pt/.pth/.ckpt). If the scan reports the file is potentially infected (malicious pickle opcodes), InvokeAI refuses to torch.load it, raising RuntimeError to protect against arbitrary code execution embedded in pickles.","triggerScenarios":"Importing a .ckpt/.pt/.pth model whose picklescan result.global_safety_check is unsafe, while config.unsafe_disable_picklescan is False (the default).","commonSituations":"Downloading models from untrusted share sites or random Civitai-style uploads; old community checkpoints that legitimately use pickle ops picklescan flags as suspicious; compromised/re-uploaded files.","solutions":["Do not import the file; get it from a trusted source or a safetensors version instead.","Verify the file's hash against the official publisher's checksum.","If you fully trust the source, set unsafe_disable_picklescan=true in InvokeAI config to bypass (convert the file to safetensors immediately afterward)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"from picklescan.scanner import scan_file_path\nresult = scan_file_path(model_file)\nif result.issues_count > 0:\n    raise SecurityError(f'{model_file} flagged unsafe by picklescan; refusing import')","typeGuard":"def is_pickle_safe(path) -> bool:\n    from picklescan.scanner import scan_file_path\n    try:\n        r = scan_file_path(path)\n        return not r.issues_count and not r.scan_err\n    except Exception:\n        return False","tryCatchPattern":"try:\n    ckpt = read_checkpoint_meta(path)\nexcept RuntimeError as e:\n    if 'potentially infected by malware' in str(e):\n        quarantine(path)  # do NOT bypass unless source is verified trusted\n    else:\n        raise","preventionTips":["Only download pickle-based checkpoints from trusted, checksum-verified sources.","Prefer safetensors models, which this scan/attack surface does not apply to.","Scan third-party .ckpt/.pt files with picklescan before importing.","Never enable unsafe_disable_picklescan for untrusted files."],"tags":["security","pickle","malware-scan"],"backgroundTag":"unsafe-pickle-detected","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}