{"record":{"id":"fe4d5f59417f194c","repo":"huggingface/smolagents","slug":"pickle-data-rejected-allow-pickle-false-requires","errorCode":null,"errorMessage":"Pickle data rejected: allow_pickle=False requires safe-only data. This data is pickle-serialized. To deserialize it, set allow_pickle=True (not recommended for untrusted data).","messagePattern":"Pickle data rejected: allow_pickle=False requires safe-only data\\. This data is pickle-serialized\\. To deserialize it, set allow_pickle=True \\(not recommended for untrusted data\\)\\.","errorType":"exception","errorClass":"SerializationError","httpStatus":null,"severity":"error","filePath":"src/smolagents/serialization.py","lineNumber":316,"sourceCode":"\n        Args:\n            data: Serialized string (with \"safe:\" or \"pickle:\" prefix)\n            allow_pickle: If False (default), reject pickle data (strict safe mode).\n                         If True, accept both safe and pickle formats.\n\n        Returns:\n            Deserialized object\n\n        Raises:\n            SerializationError: If pickle data received but allow_pickle=False\n        \"\"\"\n        if data.startswith(SafeSerializer.SAFE_PREFIX):\n            json_data = json.loads(data[len(SafeSerializer.SAFE_PREFIX) :])\n            return SafeSerializer.from_json_safe(json_data)\n        elif data.startswith(\"pickle:\"):\n            # Explicit pickle prefix\n            if not allow_pickle:\n                raise SerializationError(\n                    \"Pickle data rejected: allow_pickle=False requires safe-only data. \"\n                    \"This data is pickle-serialized. To deserialize it, set \"\n                    \"allow_pickle=True (not recommended for untrusted data).\"\n                )\n            # Warn about insecure pickle deserialization\n            import warnings\n\n            warnings.warn(\n                \"Deserializing pickle data. This is a security risk if the data is untrusted.\",\n                FutureWarning,\n                stacklevel=2,\n            )\n            return pickle.loads(base64.b64decode(data[7:]))\n        else:\n            # No prefix - legacy format, assume pickle\n            if not allow_pickle:\n                raise SerializationError(\n                    \"Pickle data rejected: allow_pickle=False requires safe-only data. \"","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/huggingface/smolagents/blob/30bb1161095dbae2271e6bc3cc4c219cc3897a57/src/smolagents/serialization.py#L298-L334","documentation":"SafeSerializer.loads was given a string with the explicit 'pickle:' prefix while allow_pickle defaults to False. The library refuses to deserialize pickle payloads unless you opt in, because pickle.loads on untrusted data leads to arbitrary code execution. The message tells you the data is explicitly pickle-formatted and you must pass allow_pickle=True.","triggerScenarios":"Calling loads (directly or via convert, _get_metadata, get_tasks_to_run, process_images_and_text, answer_questions, get_json_schema) on data produced by dumps with the pickle fallback, without setting allow_pickle=True.","commonSituations":"Loading agent state/logs saved by an older run where objects fell back to pickle; round-tripping data between processes where one side serialized with pickle fallback; migrating serialized artifacts after a library upgrade that added the safe/pickle prefix scheme.","solutions":["If the data is trusted (you produced it), call SafeSerializer.loads(data, allow_pickle=True)","Prefer re-serializing the original objects in the safe JSON format (dumps without falling into pickle) and drop the pickle payload","If data may be untrusted, do not enable pickle; regenerate or reconstruct the data safely"],"exampleFix":"# before\nobj = SafeSerializer.loads(data)  # raises: pickle-prefixed data\n\n# after\nobj = SafeSerializer.loads(data, allow_pickle=True)  # only for trusted data","handlingStrategy":"validation","validationCode":"def safe_load(data: str, trusted: bool):\n    if data.startswith(\"pickle:\") and not trusted:\n        raise ValueError(\"Refusing untrusted pickle payload\")\n    return SafeSerializer.loads(data, allow_pickle=trusted)","typeGuard":"def is_safe_prefixed(data: str) -> bool:\n    return data.startswith(SafeSerializer.SAFE_PREFIX)","tryCatchPattern":"from smolagents.serialization import SerializationError\ntry:\n    obj = SafeSerializer.loads(data)\nexcept SerializationError as e:\n    if \"allow_pickle\" in str(e) and data_is_trusted(data):\n        obj = SafeSerializer.loads(data, allow_pickle=True)\n    else:\n        raise","preventionTips":["Serialize with the safe JSON path so data never carries the pickle prefix","Keep allow_pickle=False for anything from another machine/user","Tag persisted artifacts as trusted/untrusted at write time"],"tags":["serialization","pickle","security","smolagents"],"backgroundTag":"insecure-pickle-deserialization","analyzedSha":"30bb1161095dbae2271e6bc3cc4c219cc3897a57","analyzedAt":"2026-08-28T18:52:54.169Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}