TransformersGHSA-282v-666c-3fvg
transformers has Insecure Temporary File
Medium4.7CVE-2023-2800 · Published May 18, 2023 · updated Nov 22, 2024
Insecure Temporary File in GitHub repository huggingface/transformers 4.29.2 and prior. A fix is available at commit 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 and has been released as part of version 4.30.0.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| transformers PyPI | < 4.30.0 | 4.30.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-377
- Also known as
- CVE-2023-2800, PYSEC-2023-299
- nvd.nist.gov/vuln/detail/CVE-2023-2800
- github.com/huggingface/transformers/pull/23372
- github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43
- github.com/huggingface/transformers
- github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2023-299.yaml
- huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a
More Transformers advisories
All Transformers| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face Transformers High8.8Nov 23, 2024 | High8.8 | 4.48.0 |
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face TransformersHigh7.5Nov 23, 2024 | High7.5 | 4.48.0 |
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face TransformersHigh8.8Nov 23, 2024 | High8.8 | 4.48.0 |
| Apr 102024 | Transformers Deserialization of Untrusted Data vulnerabilityLow3.4Apr 10, 2024 | Low3.4 | 4.38.0 |
| Dec 202023 | transformers has a Deserialization of Untrusted Data vulnerabilityHigh7.8Dec 20, 2023 | High7.8 | 4.36.0 |
| Dec 192023 | transformers has a Deserialization of Untrusted Data vulnerabilityCritical9.0Dec 19, 2023 | Critical9.0 | 4.36.0 |