Safetensors
A file format for model weights that stores only tensors and a JSON header, so loading a file cannot run code, unlike pickle-based PyTorch checkpoints, which can execute arbitrary code when loaded (CWE-502).
- Fix it in your stack
- Insecure deserialization fix cards (7 stacks) · CWE-502 page
- Defined in
- Hugging Face: Safetensors
- Identifiers
- CWE-502: Deserialization of untrusted data
Covered in
Treat model releases as executable supply-chain inputs
Verify provenance, constrain loading and preserve the relationship between model weights, configuration and runtime dependencies.
Parse bounded JSON and XML into an explicit application schema
Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Case study: Log4Shell (CVE-2021-44228)
How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.
Threat pattern library for threat modeling
Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities