Exploit for Deserialization of Untrusted Data in Huggingface Transformers

🗓️ 07 Dec 2024 11:24:06Reported by Piyush-BhorType

Hugging Face Transformers MaskFormer model allows arbitrary code execution via unsafe deserialization.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has vulnerabilities due to transformers package (CVE-2024-11392, CVE-2024-11393, CVE-2024-11394)	17 Jul 202518:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.46.3-py3-none-any.whl CVE-2024-12720	13 May 202507:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	8 May 202523:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to Remote Code Execution in Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	30 May 202515:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.	9 May 202509:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Hugging Face Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	2 Apr 202517:21	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in Python wheel package for the Hugging Face Transformers library affecting watsonx Code Assistant On Prem Extensions	27 Mar 202515:39	–	ibm
Chainguard	CVE-2024-11393 vulnerabilities	22 Nov 202422:15	–	cgr
Circl	CVE-2024-11393	19 Nov 202406:00	–	circl
CNNVD	Hugging Face Transformers 代码问题漏洞	22 Nov 202400:00	–	cnnvd