invoke-ai/InvokeAI · critical · RuntimeError

The model {path.stem} is potentially infected by malware. Ab

Error message

The model {path.stem} is potentially infected by malware. Aborting import.

What it means

ModelOnDisk.load_state_dict runs picklescan on pickle-based checkpoint files (.pt/.pth/.ckpt/.bin) before torch.load. If the scan flags the file as malicious (dangerous globals like exec/eval/os.system), it aborts with this RuntimeError unless unsafe_disable_picklescan is set in the config. This protects users from arbitrary code execution hidden in model pickles.

Source

Thrown at invokeai/backend/model_manager/model_on_disk.py:127

        if path in self._state_dict_cache:
            return self._state_dict_cache[path]

        path = self.resolve_weight_file(path)

        if path in self._state_dict_cache:
            return self._state_dict_cache[path]

        with SilenceWarnings():
            if path.suffix.endswith((".ckpt", ".pt", ".pth", ".bin")):
                scan_result = scan_file_path(path)
                if scan_result.infected_files != 0:
                    if get_config().unsafe_disable_picklescan:
                        logger.warning(
                            f"The model {path.stem} is potentially infected by malware, but picklescan is disabled. "
                            "Proceeding with caution."
                        )
                    else:
                        raise RuntimeError(
                            f"The model {path.stem} is potentially infected by malware. Aborting import."
                        )
                if scan_result.scan_err:
                    if get_config().unsafe_disable_picklescan:
                        logger.warning(
                            f"Error scanning the model at {path.stem} for malware, but picklescan is disabled. "
                            "Proceeding with caution."
                        )
                    else:
                        raise RuntimeError(f"Error scanning the model at {path.stem} for malware. Aborting import.")
                checkpoint = torch.load(path, map_location="cpu")
                assert isinstance(checkpoint, dict)
            elif path.suffix.endswith(".gguf"):
                checkpoint = gguf_sd_loader(path, compute_dtype=torch.float32)
            elif path.suffix.endswith(".safetensors"):
                if _is_sdnq_safetensors(path):
                    checkpoint = sdnq_sd_loader(path, compute_dtype=torch.float32)
                else:

View on GitHub (pinned to 0b6a024f2f)

Solutions

Do not import the file; obtain the same weights as a safetensors file, which cannot execute pickled code.
If you fully trust the source, temporarily set unsafe_disable_picklescan=true in invokeai.yaml and restart, then re-scan it offline.
Run picklescan yourself (picklescan --path file.ckpt) to inspect exactly which globals were flagged.
Convert the checkpoint to safetensors in a sandboxed environment, then import the converted file with scanning enabled.
Verify the file's hash against a known-good published checksum.

Example fix

// before
# invokeai.yaml
# unsafe_disable_picklescan: true   # set blindly
// after
# instead: convert once in a sandbox
python -c "import torch; sd=torch.load('model.ckpt',map_location='cpu'); from safetensors.torch import save_file; save_file({k:v for k,v in sd.items() if hasattr(v,'dtype')},'model.safetensors')"
# then import model.safetensors with picklescan enabled

Defensive patterns

Strategy: validation

Validate before calling

from picklescan import scan_file_path
result = scan_file_path(checkpoint_path)
if result.issues:
    raise RuntimeError(f'{checkpoint_path} flagged by picklescan; refusing to import')

Try / catch

try:
    sd = model_on_disk.load_state_dict(path)
except RuntimeError as e:
    if 'potentially infected by malware' in str(e):
        logger.error(f'{path} failed picklescan. Get safetensors weights or vet the file manually.')
    raise

Prevention

Prefer safetensors/gguf weights which cannot execute pickled code
Only download checkpoints from trusted publishers; verify published hashes
Never enable unsafe_disable_picklescan for untrusted community files
Scan suspicious files with `picklescan --path` in a sandbox before deciding

When it happens

Trigger: Loading a .ckpt/.pt/.pth/.bin file whose picklescan scan_result.issues are non-empty, with unsafe_disable_picklescan=False (the default), through from_state_dict, load_xlabs_state_dict, load_bnb4bit_state_dict, load_fp8_state_dict, or the ModelOnDisk constructor.

Common situations: Downloading community checkpoints from untrusted sources (Civitai, random HF repos); legacy .ckpt Stable Diffusion files known to contain pickle payloads; false positives on training checkpoints that legitimately pickle optimizers/lambdas.

Related errors

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/3683b240489334f3. Report an issue: GitHub.