Model Files Cross A Code Boundary
Pickle-based checkpoints can execute constructors during loading, while malformed archives and tensor metadata can abuse paths, offsets, or allocation limits.
tensorwarden identifies the container first, disassembles pickle opcodes without loading them, validates SafeTensors headers and byte ranges, and checks archives for traversal and embedded executable payloads.
The Demo
The scanner examines three actual files. The valid SafeTensors artifact is accepted; the pickle and traversal ZIP are quarantined with three critical findings.
Static inspection reduces loader risk but does not replace sandboxing, signatures, provenance, dependency review, or runtime resource limits.
Trying To Sneak Past My Own Scanner
A security scanner deserves an honest attempt to defeat it, not just a demo that passes. The archive path-traversal check parsed ZIP member names with a POSIX-only path type, which only recognizes forward slashes as separators. Real zip-slip exploits routinely use backslashes instead, since that's how Windows extractors interpret paths — and .pt/.pth checkpoints get loaded on Windows machines too.
Verified directly: a ZIP member named ..\..\..\outside.bin scanned as accepted with zero findings, and a Windows drive-letter absolute path like C:\Windows\System32\evil.dll did too. Both are the exact class of archive-escape attack this scanner exists to stop, and both slipped through completely undetected because the backslash-separated path parsed as one harmless-looking string instead of a traversal sequence.
Fixed by normalizing backslashes to forward slashes before path parsing and adding an explicit check for a drive-letter prefix. Forward-slash traversal, which was already caught, and legitimate nested archive members remain unaffected — only the blind spot closed.
Implementation Basis
SafeTensors was designed as a simple, safe alternative to pickle for tensor exchange.
Read the SafeTensors documentation.