-
-
Notifications
You must be signed in to change notification settings - Fork 696
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
B614 checks for the unsafe use of torch.load
with the weights_only
parameter omitted or set to False
.
model = torch.load('model_weights.pth')
A false positive is triggered when loading the equivalent TorchScript load function which has no equivalent weights_only
parameter.
https://docs.pytorch.org/docs/stable/generated/torch.jit.load.html
model = torch.jit.load('model_weights.pth')
Note also that torch.load
uses weights_only=True
by default as of version 2.6 and so B614 should query the torch version and allow torch.load
without a user-set weights_only
parameter as of version 2.6.
https://docs.pytorch.org/docs/stable/notes/serialization.html#weights-only
Reproduction steps
import torch
model = torch.jit.load('model_weights.pth')
Expected behavior
The code above should not trigger B614.
Bandit version
1.8.3 (Default)
Python version
3.13 (Default)
Additional context
No response
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working