TransformersGHSA-v68g-wm8c-6x7j
transformers has a Deserialization of Untrusted Data vulnerability
High7.8CVE-2023-7018 · Published Dec 20, 2023 · updated Nov 22, 2024
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| transformers PyPI | < 4.36.0 | 4.36.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2023-7018, PYSEC-2023-301
More Transformers advisories
All Transformers| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face Transformers High8.8Nov 23, 2024 | High8.8 | 4.48.0 |
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face TransformersHigh7.5Nov 23, 2024 | High7.5 | 4.48.0 |
| Nov 232024 | Deserialization of Untrusted Data in Hugging Face TransformersHigh8.8Nov 23, 2024 | High8.8 | 4.48.0 |
| Apr 102024 | Transformers Deserialization of Untrusted Data vulnerabilityLow3.4Apr 10, 2024 | Low3.4 | 4.38.0 |
| Dec 192023 | transformers has a Deserialization of Untrusted Data vulnerabilityCritical9.0Dec 19, 2023 | Critical9.0 | 4.36.0 |
| May 182023 | transformers has Insecure Temporary FileMedium4.7May 18, 2023 | Medium4.7 | 4.30.0 |