CVE-2024-11392

🗓️ 22 Nov 2024 21:23:27Reported by zdiType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 279 Views

Deserialization vulnerability in Hugging Face Transformers MobileViTV

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has vulnerabilities due to transformers package (CVE-2024-11392, CVE-2024-11393, CVE-2024-11394)	17 Jul 202518:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.46.3-py3-none-any.whl CVE-2024-12720	13 May 202507:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	8 May 202523:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to Remote Code Execution in Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	30 May 202515:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.	9 May 202509:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Hugging Face Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	2 Apr 202517:21	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in Python wheel package for the Hugging Face Transformers library affecting watsonx Code Assistant On Prem Extensions	27 Mar 202515:39	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Huggingface Transformers	7 Dec 202411:14	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Huggingface Transformers	18 Oct 202516:34	–	githubexploit
Chainguard	CVE-2024-11392 vulnerabilities	22 Nov 202422:15	–	cgr

NVD

Vulners

Vulnrichment

Node

huggingface transformersRange<4.48.0

[
  {
    "vendor": "Hugging Face",
    "product": "Transformers",
    "versions": [
      {
        "version": "940fde8dafaecb8f17b588c5078291f1c1a420c8",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-1513/

10 Feb 2025 22:18Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18.8

CVSS 37.5

EPSS0.5929

SSVC

CWE-502