T09 · Insecure Skill Coding Practices
- Location
ml_predictor.py:597- Finding
Unsafe Pickle Deserialization in Model Loading
- Content
View full analysis
Vulnerability Details
File Location:
ml_predictor.py:597-612
Vulnerability Type: Unsafe deserialization
Risk Level: HighVulnerable Code
python def load_model(self, path: str = "lstm_model.keras"): """加载模型和 scaler""" import pickle if TF_AVAILABLE: from tensorflow.keras.models import load_model # 自动检测文件格式 if path.endswith('.h5'): from tensorflow.keras.models import load_model as load_h5 self.model = load_h5(path, compile=True) else: self.model = load_model(path) # 加载 scaler scaler_path = path.replace('.keras', '_scaler.pkl') try: with open(scaler_path, 'rb') as f: self.scaler = pickle.load(f)Technical Analysis
The
load_model()method derives a scaler filename from a caller-provided model path and deserializes that file withpickle.load(). Python pickle is not a data-only format: serialized objects can define reduction operations that invoke arbitrary Python callables during deserialization.The code performs no authenticity, integrity, ownership, or trusted-directory validation before loading the scaler. Consequently, a malicious scaler file supplied alongside a model, downloaded from an untrusted source, or placed through local filesystem access can execute code before the method returns. Merely inspecting the expected object type after deserialization would not prevent exploitation because execution occurs during
pickle.load()itself.Attack Path
- An attacker creates a malicious pickle whose reduction method invokes an operating-system or Python function.
- The attacker distributes it as the scaler associated with a model, such as
shared_model_scaler.pkl, or replaces an existing scaler file in a writable model directory. - A user or integrating Agent calls
load_model("shared_model.keras"). - The method derives `sha ...[truncated 816 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not use pickle for scaler persistence. Store data-only scaler attributes such as
mean_,scale_,var_, andn_features_in_in JSON or NumPy files and reconstruct a known scaler class explicitly. - Treat both model and scaler files as executable or security-sensitive artifacts. Load them only from an application-controlled directory.
- Verify artifacts using a cryptographic signature or an authenticated manifest before parsing them. A hash obtained from the same untrusted source is insufficient.
- Reject symlinks and paths outside the approved model directory after resolving the canonical path.
- Apply restrictive ownership and filesystem permissions to the artifact directory.
- If backward compatibility requires pickle, clearly document that only trusted, locally generated pickle files may be loaded and isolate loading in a sandboxed process with minimal filesystem and network privileges.
- Do not use pickle for scaler persistence. Store data-only scaler attributes such as