Skip to content

B614 False Positive when using torch.jit.load #1293

@Chris-tpt

Description

@Chris-tpt

Describe the bug

B614 checks for the unsafe use of torch.load with the weights_only parameter omitted or set to False.

model = torch.load('model_weights.pth')

A false positive is triggered when loading the equivalent TorchScript load function which has no equivalent weights_only parameter.

https://docs.pytorch.org/docs/stable/generated/torch.jit.load.html

model = torch.jit.load('model_weights.pth')

Note also that torch.load uses weights_only=True by default as of version 2.6 and so B614 should query the torch version and allow torch.load without a user-set weights_only parameter as of version 2.6.

https://docs.pytorch.org/docs/stable/notes/serialization.html#weights-only

Reproduction steps

import torch
model = torch.jit.load('model_weights.pth')

Expected behavior

The code above should not trigger B614.

Bandit version

1.8.3 (Default)

Python version

3.13 (Default)

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions