-
-
Notifications
You must be signed in to change notification settings - Fork 705
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
B614 checks for the unsafe use of torch.load with the weights_only parameter omitted or set to False.
model = torch.load('model_weights.pth')
A false positive is triggered when loading the equivalent TorchScript load function which has no equivalent weights_only parameter.
https://docs.pytorch.org/docs/stable/generated/torch.jit.load.html
model = torch.jit.load('model_weights.pth')
Note also that torch.load uses weights_only=True by default as of version 2.6 and so B614 should query the torch version and allow torch.load without a user-set weights_only parameter as of version 2.6.
https://docs.pytorch.org/docs/stable/notes/serialization.html#weights-only
Reproduction steps
import torch
model = torch.jit.load('model_weights.pth')Expected behavior
The code above should not trigger B614.
Bandit version
1.8.3 (Default)
Python version
3.13 (Default)
Additional context
No response
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working