TransformersGHSA-3863-2447-669p
transformers has a Deserialization of Untrusted Data vulnerability
Critical9.0CVE-2023-6730 · Published Dec 19, 2023 · updated Nov 22, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| transformers PyPI | < 4.36.0 | 4.36.0 |
Details and references
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2023-6730, PYSEC-2023-300
More Transformers advisories
All Transformers| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 202023 | transformers has a Deserialization of Untrusted Data vulnerability CVE-2023-7018High7.8fixed in 4.36.0 | High7.8 | 4.36.0 |
| Apr 102024 | Transformers Deserialization of Untrusted Data vulnerability CVE-2024-3568Low3.4fixed in 4.38.0 | Low3.4 | 4.38.0 |
| May 182023 | transformers has Insecure Temporary File CVE-2023-2800Medium4.7fixed in 4.30.0 | Medium4.7 | 4.30.0 |
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11394High8.8fixed in 4.48.0 | High8.8 | 4.48.0 |
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11392High7.5fixed in 4.48.0 | High7.5 | 4.48.0 |
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11393High8.8fixed in 4.48.0 | High8.8 | 4.48.0 |