Advisoriesby IbisTransformersGHSA-282v-666c-3fvg
transformers has Insecure Temporary File
Fix: upgrade to 4.30.0 or later
Insecure Temporary File in GitHub repository huggingface/transformers 4.29.2 and prior. A fix is available at commit 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 and has been released as part of version 4.30.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| transformers PyPI | < 4.30.0 | 4.30.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-377
- Also known as
- CVE-2023-2800, PYSEC-2023-299
- nvd.nist.gov/vuln/detail/CVE-2023-2800
- github.com/huggingface/transformers/pull/23372
- github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43
- github.com/huggingface/transformers
- github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2023-299.yaml
- huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a
More Transformers advisories
All Transformers
Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11393fixed in 4.48.0Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11392fixed in 4.48.0Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11394fixed in 4.48.0Transformers Deserialization of Untrusted Data vulnerabilityCVE-2024-3568fixed in 4.38.0transformers has a Deserialization of Untrusted Data vulnerabilityCVE-2023-7018fixed in 4.36.0transformers has a Deserialization of Untrusted Data vulnerabilityCVE-2023-6730fixed in 4.36.0