transformers has a Deserialization of Untrusted Data vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-6730 · ADVISORY
• huggingface/transformers commit 1d63b0e · WEB
• huggingface/transformers · PACKAGE
• pypa/advisory-database · WEB
• huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16 · WEB
• GitHub Advisory GHSA-3863-2447-669p · ADVISORY

transformers のその他の脆弱性

• CVE-2026-80047高 7.8A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user…
• CVE-2026-9856高 7.1A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th…
• CVE-2026-5241緊急 9.6A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository…
• CVE-2026-4372高 7.8A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vu…
• CVE-2026-1839高 7.8A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_loa…