{"record":{"id":"faadfda59e676e48","repo":"mem0ai/mem0","slug":"failed-to-load-faiss-docstore-potentially-malicio","errorCode":null,"errorMessage":"Failed to load FAISS docstore: potentially malicious pickle file. {e}","messagePattern":"Failed to load FAISS docstore: potentially malicious pickle file\\. (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"mem0/vector_stores/faiss.py","lineNumber":221,"sourceCode":"                # This prevents arbitrary code execution from malicious pickle files\n                logger.warning(\n                    f\"Loading legacy pickle docstore from {docstore_path}. \"\n                    f\"Consider migrating to JSON format for better security.\"\n                )\n                data = _safe_pickle_load(docstore_path)\n                self.docstore, self.index_to_id = _validate_docstore_structure(data)\n                logger.info(f\"Loaded FAISS index from {index_path} with {self.index.ntotal} vectors (pickle format)\")\n\n                # Auto-migrate to JSON format\n                self._save()\n                logger.info(f\"Migrated docstore to JSON format: {json_docstore_path}\")\n\n            else:\n                raise FileNotFoundError(f\"No docstore found at {docstore_path} or {json_docstore_path}\")\n\n        except pickle.UnpicklingError as e:\n            logger.error(f\"Security error loading FAISS docstore: {e}\")\n            raise ValueError(f\"Failed to load FAISS docstore: potentially malicious pickle file. {e}\") from e\n        except Exception as e:\n            logger.warning(f\"Failed to load FAISS index: {e}\")\n            self.docstore = {}\n            self.index_to_id = {}\n\n    def _save(self):\n        \"\"\"Save FAISS index and docstore to disk using JSON format (secure).\"\"\"\n        if not self.path or not self.index:\n            return\n\n        try:\n            os.makedirs(self.path, exist_ok=True)\n            index_path = f\"{self.path}/{self.collection_name}.faiss\"\n            json_docstore_path = f\"{self.path}/{self.collection_name}.json\"\n\n            faiss.write_index(self.index, index_path)\n\n            # Save docstore as JSON (safe format, no code execution risk)","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/mem0/vector_stores/faiss.py#L203-L239","documentation":"Raised when the legacy pickle docstore fails to unpickle with pickle.UnpicklingError — mem0 treats this as a potential pickle-bomb and aborts with a security ValueError instead of executing arbitrary pickle opcodes. This is deliberate: pickles can execute code on load, so failures are escalated loudly.","triggerScenarios":"Loading a faiss.docstore pickle that is malformed, truncated, or crafted; also raised when a non-pickle file (renamed JSON or text) sits at the pickle path and raises UnpicklingError inside _safe_pickle_load.","commonSituations":"Downloading a docstore from an untrusted source; file corruption in transit or from a partial write; tampering detection; transferring files between Python versions with incompatible pickle protocols.","solutions":["Do not load the file; treat it as untrusted and source a clean copy from a trusted backup","If you control the origin, regenerate the docstore and let mem0 save in JSON format (auto-migration happens after a successful pickle load)","Delete the legacy pickle and rebuild the store so only the secure JSON format is used going forward"],"exampleFix":"# before\n# untrusted faiss.docstore left in the directory\nvs = FAISS(config)  # ValueError: potentially malicious pickle file\n\n# after\nimport os\nfor f in ('faiss.docstore',):\n    p = os.path.join(config.path, f)\n    if os.path.exists(p):\n        os.remove(p)  # force clean rebuild; or restore from trusted backup","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    vs = FAISS(config)\nexcept ValueError as e:\n    if 'potentially malicious pickle' in str(e):\n        # quarantine the file, alert security, rebuild from trusted source\n        raise","preventionTips":["Only load pickle docstores from sources you fully trust","Migrate legacy pickle stores to JSON on first successful load (mem0 auto-migrates) and then delete the pickle","Never download or sync faiss.docstore files over untrusted channels"],"tags":["faiss","security","pickle","deserialization"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}