transformers has a Deserialization of Untrusted Data vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-6730 · ADVISORY
• huggingface/transformers commit 1d63b0e · WEB
• huggingface/transformers · PACKAGE
• pypa/advisory-database · WEB
• huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16 · WEB
• GitHub Advisory GHSA-3863-2447-669p · ADVISORY

Autres vulnérabilités de transformers

• CVE-2026-80047ÉLEVÉE 7.8A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user…
• CVE-2026-9856ÉLEVÉE 7.1A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th…
• CVE-2026-5241CRITIQUE 9.6A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository…
• CVE-2026-4372ÉLEVÉE 7.8A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vu…
• CVE-2026-1839ÉLEVÉE 7.8A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_loa…