AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

TransformersGHSA-v68g-wm8c-6x7j

transformers has a Deserialization of Untrusted Data vulnerability

Transformers

CVE-2023-7018 · Published Dec 20, 2023 · updated Nov 22, 2024

High7.8
Fix: upgrade to 4.36.0 or later
GitHub advisory

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Affected versions

PackageAffectedFixed in
transformers
PyPI
< 4.36.04.36.0
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
CVE-2023-7018, PYSEC-2023-301

More Transformers advisories

All Transformers
High 8.8Nov 23, 2024Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11393fixed in 4.48.0High 7.5Nov 23, 2024Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11392fixed in 4.48.0High 8.8Nov 23, 2024Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11394fixed in 4.48.0Low 3.4Apr 10, 2024Transformers Deserialization of Untrusted Data vulnerabilityCVE-2024-3568fixed in 4.38.0Critical 9.0Dec 19, 2023transformers has a Deserialization of Untrusted Data vulnerabilityCVE-2023-6730fixed in 4.36.0Medium 4.7May 18, 2023transformers has Insecure Temporary FileCVE-2023-2800fixed in 4.30.0