AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

TransformersGHSA-3863-2447-669p

transformers has a Deserialization of Untrusted Data vulnerability

Transformers

CVE-2023-6730 · Published Dec 19, 2023 · updated Nov 22, 2024

Critical9.0
Fix: upgrade to 4.36.0 or later
GitHub advisory

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0.

Affected versions

PackageAffectedFixed in
transformers
PyPI
< 4.36.04.36.0
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
CVE-2023-6730, PYSEC-2023-300

More Transformers advisories

All Transformers
High 8.8Nov 23, 2024Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11393fixed in 4.48.0High 7.5Nov 23, 2024Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11392fixed in 4.48.0High 8.8Nov 23, 2024Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11394fixed in 4.48.0Low 3.4Apr 10, 2024Transformers Deserialization of Untrusted Data vulnerabilityCVE-2024-3568fixed in 4.38.0High 7.8Dec 20, 2023transformers has a Deserialization of Untrusted Data vulnerabilityCVE-2023-7018fixed in 4.36.0Medium 4.7May 18, 2023transformers has Insecure Temporary FileCVE-2023-2800fixed in 4.30.0