Read a PyTorch checkpoint's pickle without running it

GHSA-9gvj-pp9x-gcfr describes a parsing bug in picklescan's _list_globals. Handling STACK_GLOBAL at op index n, the backwards scan for the two string operands looped range(1, n), which reaches op index n-1 down to 1 and never reaches index 0. The advisory's own words:

"The loop only consider the range from 1 to n-1 but forgets to consider the opcode at position 0. The correct range should be 0 to n-1."

In a protocol 0 or 1 pickle there is no PROTO opcode, so index 0 is a real operand. Put one of the two names there and the scan finds only one value, raises ValueError, and the scan errors out instead of reporting. This page reimplements all three behaviours from the published source and runs them on the advisory's exact 26-byte payload, so the hole cannot be inherited here without the test going red.

Reading the file

• A .pt saved by torch.save is a ZIP. The page reads the last 66000 bytes through File.slice, which covers a maximum-length archive comment plus the ZIP64 locator, finds the end-of-central-directory record, walks the central directory, and then slices only the bytes of each pickle member. Tensor data is never read. A multi-gigabyte checkpoint costs a few kilobytes of transfer from disk.
• ZIP64 is handled: when the classic record carries the 0xFFFF / 0xFFFFFFFF sentinels the page follows the ZIP64 locator and record, and reads the 64-bit fields from the per-entry 0x0001 extra field.
• Every archive member whose name ends in .pkl or .debug_pkl is walked, not just data.pkl, because a TorchScript archive also carries constants.pkl, callstack_debug_map.pkl and one code/<name>.py.debug_pkl per source file. Those debug records are pickles.
• Stored members are read as-is. PyTorchStreamWriter::writeRecord declares bool compress = false, and every call on the torch.save path takes that default, so a plain checkpoint is stored rather than deflated. TorchScript is the exception: export_module.cpp passes size > kMinToCompress with kMinToCompress = 200, so source files and .debug_pkl records over 200 bytes are deflated. Those go through DecompressionStream("deflate-raw"), which MDN marks as available across browsers since May 2023, so there is no bundled inflate and no wasm. Extracted bytes are CRC32-checked against the central directory value.
• The legacy non-ZIP torch.save format is refused, not guessed at. Its first record is a protocol 2 pickle of the magic number 0x1950A86A20F9469CFC6C, which the page recognises by its exact 14-byte prefix, and the even older tar layout is recognised by the ustar marker at offset 257. Mis-parsing those quietly would be worse than saying no.

Resolving imports

• GLOBAL carries module and name inline, so a text scan finds it. STACK_GLOBAL does not: the module and the name are pushed as two separate stack items and never appear as one contiguous token. This page therefore runs a real pickle stack, including the memo, the mark stack and the metastack, and pops the two operands the way CPython does. That also means a STACK_GLOBAL fed from BINGET resolves correctly.
• The opcode table covers all 68 opcodes CPython's pickle module defines across protocols 0 through 5, so an argument length is never guessed. Strings are rendered as printable ASCII with \xNN and \uNNNN escapes, so a module name carrying control characters or bidi overrides cannot disguise itself in the output of a tool you are using to look for disguises.
• Lookups use null-prototype maps, so an import literally named __proto__ or constructor is reported as what it is instead of colliding with a JavaScript built-in. There is a self-test for it.

The weights_only decision

• Two finite tables from torch/_weights_only_unpickler.py: the opcodes the loop implements, and the globals _get_allowed_globals() registers. Both are in section 7, dated and marked as vendor data.
• Torch applies the Python 2 to 3 rename tables to a GLOBAL before checking the blocklist, so __builtin__.intern becomes sys.intern and is blocked by module. That rewrite is implemented here.
• Torch raises on the first problem it hits. The page shows that one as the blocker and lists the rest as what you would hit next.

What this tool does not decide

These checks in torch's unpickler depend on runtime object types, which a static reader cannot know. If your file only trips one of these, this page will say "no blocker found" and torch will still refuse. That is a real gap and it is stated here rather than buried:

• BUILD is restricted to Tensor, Parameter, OrderedDict or an allowlisted type, judged by the runtime type of the instance.
• APPEND and APPENDS are restricted to list and to allowlisted list subclasses.
• SETITEM and SETITEMS are restricted to dict, OrderedDict and Counter.
• BINPERSID requires the persistent id to be a tuple or int whose first element decodes to "storage".
• Anything an allowlisted rebuild function does with the arguments it is handed.

And the wider point: a file that weights_only=True accepts is not thereby a file you should trust with weights_only=False. The torch documentation is blunt about the general case: "torch.load() uses an unpickler under the hood. Never load data from an untrusted source."

Primary sources

• torch/_weights_only_unpickler.py at v2.13.0 - the allowed-globals table, the opcode chain, the blocklist and the exact error strings.
• torch/serialization.py at v2.13.0 - MAGIC_NUMBER = 0x1950A86A20F9469CFC6C, _is_zipfile checking for the local header magic PK\x03\x04, and the data.pkl record name. Note the signature is weights_only: bool | None = None, not True: _default_to_weights_only() resolves None to True only when pickle_module is None and the build is not fbcode, so passing a pickle_module silently opts you back out.
• caffe2/serialize/inline_container.h at v2.13.0 - PyTorchStreamWriter::writeRecord declares bool compress = false, and the torch.save path takes that default. export_module.cpp is the one caller that overrides it, with static constexpr size_t kMinToCompress = 200, which is why TorchScript source and .debug_pkl records can arrive deflated.
• torch/csrc/utils/tensor_types.cpp at v2.13.0 - all_declared_types() lists {CPU, CUDA, SparseCPU, SparseCUDA} as an unconditional literal, so the torch.cuda.*Tensor rows are build-independent, and skips Bool for the sparse backends with the comment "there is no sparse bool type".
• PyTorch 2.6.0 release notes - "Flip default torch.load to weights_only".
• GHSA-9gvj-pp9x-gcfr / CVE-2025-71325 - the picklescan STACK_GLOBAL range bug, its proof of concept and its disassembly offsets.
• picklescan scanner.py at v1.0.5 and at the vulnerable commit - the two _list_globals loops reimplemented in section 6. The 0.0.27 release changed both the range and the string-opcode list.
• Python pickletools and CPython Lib/pickle.py - the opcode byte values and argument encodings.
• MDN DecompressionStream() - deflate-raw is documented as "Decompress the stream using the DEFLATE algorithm without a header and trailing checksum", and the API is marked "available across browsers since May 2023".
• PKWARE APPNOTE.TXT - ZIP end-of-central-directory, central directory and ZIP64 record layouts.

Every fixture below was disassembled with Python's pickletools first, and the expected offsets are that output. The CVE row's expected offsets come from the advisory text itself.