transformers - 💡(How to fix) Fix HIGH: Pickle model loading (torch.load) enabled by default — no warning when loading untrusted weights

CWE-502: Deserialization of Untrusted Data — Pickle model loading enabled by default

Severity: HIGH (CVSS 7.8)

Location

src/transformers/modeling_utils.py — from_pretrained() default behavior

Description

The SECURITY.md explicitly warns:

"We heavily recommend uploading and downloading models in the safetensors format... To avoid loading models from unsafe formats (e.g. pickle), you should use the use_safetensors parameter."

However, use_safetensors defaults to None (auto-detect), which means:

1. If a model repository contains only .bin/pickle files, they are loaded via torch.load() — which executes arbitrary Python
2. If both .safetensors and .bin files exist, safetensors is preferred, but pickle fallback still happens silently
3. Users downloading community models from the HF Hub may not realize pickle execution is happening

The SECURITY.md does a great job documenting the risk, but the library default behavior does not protect users who don't read the security docs. A FutureWarning or explicit opt-in for pickle loading would provide defense-in-depth.

Impact

Users loading untrusted/community models can have arbitrary code executed on their machine via pickle deserialization. This is particularly dangerous in automated pipelines that load models from user-provided repository IDs.

Remediation

1. Emit a FutureWarning when pickle weights are loaded without explicit use_safetensors=False
2. Plan a deprecation timeline where pickle becomes opt-in only
3. Add a prominent one-time warning on first pickle load: "This model uses pickle format which can execute arbitrary code. Set use_safetensors=True to load only safetensors models."