{"record":{"id":"de68aa0033e5e93b","repo":"Lightning-AI/pytorch-lightning","slug":"the-instantiator-instantiator-path-r-from-the-ch","errorCode":null,"errorMessage":"The instantiator {instantiator_path!r} from the checkpoint is not in the allowlist of trusted instantiators and was blocked to prevent arbitrary code execution. If you trust this checkpoint, add the path to `lightning.pytorch.core.saving._ALLOWED_INSTANTIATORS` before loading.","messagePattern":"The instantiator (.+?) from the checkpoint is not in the allowlist of trusted instantiators and was blocked to prevent arbitrary code execution\\. If you trust this checkpoint, add the path to `lightning\\.pytorch\\.core\\.saving\\._ALLOWED_INSTANTIATORS` before loading\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"src/lightning/pytorch/core/saving.py","lineNumber":166,"sourceCode":"        cls_kwargs_loaded.update(checkpoint.get(cls.CHECKPOINT_HYPER_PARAMS_KEY, {}))\n\n        # 3. Ensure that `cls_kwargs_old` has the right type, back compatibility between dict and Namespace\n        cls_kwargs_loaded = _convert_loaded_hparams(cls_kwargs_loaded, checkpoint.get(cls.CHECKPOINT_HYPER_PARAMS_TYPE))\n\n        # 4. Update cls_kwargs_new with cls_kwargs_old, such that new has higher priority\n        args_name = checkpoint.get(cls.CHECKPOINT_HYPER_PARAMS_NAME)\n        if args_name and args_name in cls_init_args_name:\n            cls_kwargs_loaded = {args_name: cls_kwargs_loaded}\n\n    _cls_kwargs = {}\n    _cls_kwargs.update(cls_kwargs_loaded)\n    _cls_kwargs.update(cls_kwargs_new)\n\n    instantiator = None\n    instantiator_path = _cls_kwargs.pop(\"_instantiator\", None)\n    if instantiator_path is not None:\n        if instantiator_path not in _ALLOWED_INSTANTIATORS:\n            raise ValueError(\n                f\"The instantiator {instantiator_path!r} from the checkpoint is not in the allowlist of trusted\"\n                \" instantiators and was blocked to prevent arbitrary code execution. If you trust this checkpoint,\"\n                \" add the path to `lightning.pytorch.core.saving._ALLOWED_INSTANTIATORS` before loading.\"\n            )\n        module_path, name = instantiator_path.rsplit(\".\", 1)\n        instantiator = getattr(__import__(module_path, fromlist=[name]), name)\n\n    if not cls_spec.varkw:\n        # filter kwargs according to class init unless it allows any argument via kwargs\n        _cls_kwargs = {k: v for k, v in _cls_kwargs.items() if k in cls_init_args_name}\n\n    obj = instantiator(cls, _cls_kwargs) if instantiator else cls(**_cls_kwargs)\n\n    if isinstance(obj, pl.LightningDataModule):\n        if obj.__class__.__qualname__ in checkpoint:\n            obj.load_state_dict(checkpoint[obj.__class__.__qualname__])\n        return obj\n","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/Lightning-AI/pytorch-lightning/blob/9fed5c27d2a62ff0efd6c3573599921d6ff67c14/src/lightning/pytorch/core/saving.py#L148-L184","documentation":"Security guard in _load_state: checkpoints may embed an `_instantiator` entry naming a callable (module.path.to.fn) that Lightning will import and call to rebuild the object. Because that is arbitrary code execution, the path must appear in the explicit allowlist `lightning.pytorch.core.saving._ALLOWED_INSTANTIATORS` or loading aborts.","triggerScenarios":"Loading a checkpoint saved by Lightning AI's studio/app flows (or a crafted one) whose hyperparameters contain `_instantiator='some.module.fn'` where 'some.module.fn' is not in the allowlist.","commonSituations":"Downloading or receiving a checkpoint created elsewhere (studio export, another org, tutorial artifact) and calling load_from_checkpoint on it; the embedded instantiator path is not one Lightning trusts by default.","solutions":["Inspect checkpoint['hyper_parameters']['_instantiator'] with torch.load to see the path","If you trust the source, append the path: from lightning.pytorch.core.saving import _ALLOWED_INSTANTIATORS; _ALLOWED_INSTANTIATORS.add(path) before loading","Otherwise strip the key: pop '_instantiator' from the checkpoint's hyper_parameters and load without it"],"exampleFix":"// before\nmodel = MyModel.load_from_checkpoint(ckpt)  # ValueError: instantiator blocked\n// after\nfrom lightning.pytorch.core.saving import _ALLOWED_INSTANTIATORS\n_ALLOWED_INSTANTIATORS.add(\"litdata.streaming.ini\")\nmodel = MyModel.load_from_checkpoint(ckpt)","handlingStrategy":"validation","validationCode":"ckpt = torch.load(path, map_location=\"cpu\", weights_only=False)\ninst = ckpt.get(\"hyper_parameters\", {}).get(\"_instantiator\")\nif inst is not None and inst not in _ALLOWED_INSTANTIATORS:\n    # decide: trust it or strip it\n    ckpt[\"hyper_parameters\"].pop(\"_instantiator\")","typeGuard":null,"tryCatchPattern":"from lightning.pytorch.core.saving import _ALLOWED_INSTANTIATORS\ntry:\n    model = cls.load_from_checkpoint(p)\nexcept ValueError as e:\n    if \"_ALLOWED_INSTANTIATORS\" in str(e) and trust_source:\n        _ALLOWED_INSTANTIATORS.add(extract_path_from(e))\n    else:\n        raise","preventionTips":["Only load checkpoints from trusted sources","Inspect _instantiator before loading untrusted checkpoints","Keep the allowlist modification scoped and audited"],"tags":["lightning","checkpoint","security","arbitrary-code-execution","allowlist"],"backgroundTag":"untrusted-checkpoint-blocked","analyzedSha":"9fed5c27d2a62ff0efd6c3573599921d6ff67c14","analyzedAt":"2026-08-28T11:52:41.083Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}