It is safe only for files from sources you trust. The pandas documentation warns that loading pickled data from untrusted sources can be unsafe, and links to the Python pickle docs, which say unpickling can execute arbitrary code. For data shared across teams, use a plain data format.
What the warning says
The read_pickle page says loading pickled data received from untrusted sources can be unsafe, and refers you to the Python pickle documentation. That documentation states that the module is not secure and that a malicious stream can execute arbitrary code during unpickling.
Notice the wording is about the source, not the file extension. A file named data.pkl on a shared drive is only as trustworthy as the least trusted person who can write to that drive.
When pickle is fine
- A cache your own job writes and reads, in a location only that job can modify.
- Short lived intermediate files within one run.
When it is not
- Files downloaded from the internet or a vendor.
- Files uploaded by a user or customer.
- Anything that crosses a trust boundary, such as one team handing a DataFrame to another.
- Shared notebooks that load pickles from a folder others can change.
What to use instead
| Need | Choice |
|---|---|
| Tabular data between teams | Parquet or CSV |
| Nested records | JSON lines |
| Preserving exact pandas types | Parquet usually keeps column types |
| A trained model | See the scikit-learn guidance on safer formats |
These format suggestions are general practice, not quotes from the pandas page. The principle the Python docs give is that deserializing untrusted JSON does not in itself create an arbitrary code execution vulnerability. Plain data formats parse data. Pickle executes instructions.
Steps to clean up
- Search your repos and notebooks for read_pickle, pickle load and joblib load.
- Mark each by source: who writes the file, and who can modify it.
- Switch the cross boundary ones to a plain format.
- Lock down the rest. Restrict write access to the folder or bucket, and log changes.
- Add a review rule that new pickle loads on external data need a second reviewer.
- Add a linter or code scanning rule where your tools allow it.
If you work with models, joblib files carry the same risk. Our broader pandas security guide covers other angles.
Try it yourself
Open the demo and watch how reachability analysis separates a vulnerable function that is called from one that is not.
Click through it at your own pace, or open it full screen.
Quick check
Is a pickle from my own laptop safe?
Usually, if nothing else could have changed it. The risk is who could have written or replaced the file.
Does Parquet execute code on read?
Reading a Parquet file parses data, unlike unpickling, which can run instructions. Keep your reader library patched, since parsers can have bugs too.
Safeguard dependency scanning and reachability analysis can help you see whether a vulnerable library in your pipeline is actually used. Try the demo below.
Sources
Last reviewed: 19 October 2026.
