invoke-ai/InvokeAI · critical · RuntimeError

The model {path} is potentially infected by malware. Abortin

Error message

The model {path} is potentially infected by malware. Aborting import.

What it means

read_checkpoint_meta() runs picklescan on pickle-based checkpoints (.pt/.pth/.ckpt). If the scan reports the file is potentially infected (malicious pickle opcodes), InvokeAI refuses to torch.load it, raising RuntimeError to protect against arbitrary code execution embedded in pickles.

Source

Thrown at invokeai/backend/model_manager/util/model_util.py:72

            path_str = path.as_posix() if isinstance(path, Path) else path
            checkpoint = _fast_safetensors_reader(path_str)
        except Exception:
            # TODO: create issue for support "meta"?
            checkpoint = safetensors.torch.load_file(path, device="cpu")
    elif str(path).endswith(".gguf"):
        # The GGUF reader used here uses numpy memmap, so these tensors are not loaded into memory during this function
        checkpoint = gguf_sd_loader(Path(path), compute_dtype=torch.float32)
    else:
        if scan:
            scan_result = pscan.scan_file_path(path)
            if scan_result.infected_files != 0:
                if get_config().unsafe_disable_picklescan:
                    logger.warning(
                        f"The model {path} is potentially infected by malware, but picklescan is disabled. "
                        "Proceeding with caution."
                    )
                else:
                    raise RuntimeError(f"The model {path} is potentially infected by malware. Aborting import.")
            if scan_result.scan_err:
                if get_config().unsafe_disable_picklescan:
                    logger.warning(
                        f"Error scanning the model at {path} for malware, but picklescan is disabled. "
                        "Proceeding with caution."
                    )
                else:
                    raise RuntimeError(f"Error scanning the model at {path} for malware. Aborting import.")

        checkpoint = torch.load(path, map_location=torch.device("meta"))
    return checkpoint


def lora_token_vector_length(checkpoint: dict[str | int, torch.Tensor]) -> Optional[int]:
    """
    Given a checkpoint in memory, return the lora token vector length

    :param checkpoint: The checkpoint

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Do not import the file; get it from a trusted source or a safetensors version instead.
2. Verify the file's hash against the official publisher's checksum.
3. If you fully trust the source, set unsafe_disable_picklescan=true in InvokeAI config to bypass (convert the file to safetensors immediately afterward).

from picklescan.scanner import scan_file_path
result = scan_file_path(model_file)
if result.issues_count > 0:
    raise SecurityError(f'{model_file} flagged unsafe by picklescan; refusing import')

def is_pickle_safe(path) -> bool:
    from picklescan.scanner import scan_file_path
    try:
        r = scan_file_path(path)
        return not r.issues_count and not r.scan_err
    except Exception:
        return False

try:
    ckpt = read_checkpoint_meta(path)
except RuntimeError as e:
    if 'potentially infected by malware' in str(e):
        quarantine(path)  # do NOT bypass unless source is verified trusted
    else:
        raise

When it happens

Trigger: Importing a .ckpt/.pt/.pth model whose picklescan result.global_safety_check is unsafe, while config.unsafe_disable_picklescan is False (the default).

Common situations: Downloading models from untrusted share sites or random Civitai-style uploads; old community checkpoints that legitimately use pickle ops picklescan flags as suspicious; compromised/re-uploaded files.

Related errors

• The model {path.stem} is potentially infected by malware. Ab
• Error scanning the model at {path.stem} for malware. Abortin
• Error scanning the model at {path} for malware. Aborting imp
• only relative download paths accepted
• Cannot derive a safe filename for {url} from '{file_name}'

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/de1636a1e26a9d3e. Report an issue: GitHub.