transformers has a Deserialization of Untrusted Data vulnerability

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2023-7018 · ADVISORY
• huggingface/transformers commit 1d63b0e · WEB
• huggingface/transformers · PACKAGE
• pypa/advisory-database · WEB
• huntr.com/bounties/e1a3e548-e53a-48df-b708-9ee62140963c · WEB
• GitHub Advisory GHSA-v68g-wm8c-6x7j · ADVISORY

Lỗ hổng khác của transformers

• CVE-2026-80047CAO 7.8A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user…
• CVE-2026-9856CAO 7.1A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th…
• CVE-2026-5241NGHIÊM TRỌNG 9.6A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository…
• CVE-2026-4372CAO 7.8A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vu…
• CVE-2026-1839CAO 7.8A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_loa…