-
-
Notifications
You must be signed in to change notification settings - Fork 734
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
B614 checks for the unsafe use of torch.load with the weights_only parameter omitted or set to False.
model = torch.load('model_weights.pth')
A false positive is triggered when loading the equivalent TorchScript load function which has no equivalent weights_only parameter.
https://docs.pytorch.org/docs/stable/generated/torch.jit.load.html
model = torch.jit.load('model_weights.pth')
Note also that torch.load uses weights_only=True by default as of version 2.6 and so B614 should query the torch version and allow torch.load without a user-set weights_only parameter as of version 2.6.
https://docs.pytorch.org/docs/stable/notes/serialization.html#weights-only
Reproduction steps
import torch
model = torch.jit.load('model_weights.pth')Expected behavior
The code above should not trigger B614.
Bandit version
1.8.3 (Default)
Python version
3.13 (Default)
Additional context
No response
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working