a2 (>=0.10.5, <=0.10.13), africanwhisper (>=0.2.3, <=0.9.0) +17 more potentially affected by CVE-2026-69112 via accelerate (0.28.0)

accelerate PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - a2 =0.10.5, =0.2.3, =0.0.3, =0.7.16, =0.0.1, =0.1.0, =4.0.0rc4, =0.3.0, =1.0.3.post1, =0.1.0, =1.0.9, =0.1.0, =0.1.1 - stepgot 0.1.0 and mo...

autogluon-multimodal (>=0.6.3b20230121, <=0.6.3b20230203), deepfloyd-if (>=0.0.1rc5, <=1.0.2rc0) +8 more potentially affected by CVE-2026-69112 via accelerate (0.15.0)

accelerate PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - autogluon-multimodal =0.6.3b20230121, =0.0.1rc5, =0.1.0, =0.0.7, =3.0.0, =0.1.1, =1.0.0, =0.3.0, =0.3.3 Source cves: CVE-2026-69112 Source...

pytorch-clip-interrogator (>=2023.2.19.0, <=2023.2.19.1), stochasticx (>=0.0.14, <=0.0.19) +2 more potentially affected by CVE-2026-69112 via accelerate (0.14.0)

accelerate PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - pytorch-clip-interrogator =2023.2.19.0, =0.0.14, =0.1.0, =0.0.7, =0.0.9 Source cves: CVE-2026-69112 Source advisory: OSV:PYSEC-2026-3804...

arcee-align (0.0.6), dallm (0.0.6) +2 more potentially affected by CVE-2026-69112 via accelerate (0.20.1)

accelerate PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - arcee-align 0.0.6 - dallm 0.0.6 - inranker 1.1.0 - sig-networks =0.1.0, =0.2.0 Source cves: CVE-2026-69112 Source advisory:...

autotrain-advanced (>=0.8.18, <=0.8.25) potentially affected by CVE-2026-69112 via accelerate (0.34.1)

accelerate PYPI version 0.34.1 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - autotrain-advanced =0.8.18, =0.8.25 Source cves: CVE-2026-69112 Source advisory: OSV:PYSEC-2026-3804...

CVE-2026-69112 vulnerabilities

Vulnerabilities for packages: nemo, py3-accelerate-cuda-12.9, py3-accelerate-cuda-13.0, vllm-openai-cuda-12.9, vllm-openai-cuda-13.0...

autotrain-advanced (>=0.6.42, <=0.6.51), nlpbaselines (0.0.26) potentially affected by CVE-2026-69112 via accelerate (0.24.0)

accelerate PYPI version 0.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - autotrain-advanced =0.6.42, =0.6.51 - nlpbaselines 0.0.26 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

autotrain-advanced (>=0.8.6, <=0.8.8) potentially affected by CVE-2026-69112 via accelerate (0.32.0)

accelerate PYPI version 0.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - autotrain-advanced =0.8.6, =0.8.8 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

atomgpt (2024.11.30), autotrain-advanced (>=0.7.119, <=0.8.5) +29 more potentially affected by CVE-2026-69112 via accelerate (0.31.0)

accelerate PYPI version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - atomgpt 2024.11.30 - autotrain-advanced =0.7.119, =0.1.0, =0.1.3, =0.1.0, =0.0.4.5, =0.1.0, =0.3.1, =1.0.0, =0.1.0, =0.1.9 - ragcheckerzsv4...

agilerl (>=2.4.2.dev0, <=2.7.0), ai2-catwalk (0.2.2) +210 more potentially affected by CVE-2026-69112 via accelerate (>=1.0.1, <=1.14.0)

accelerate PYPI version =1.0.1, =2.4.2.dev0, =0.1.8, =3.1.8, =0.0.0, =0.1.0rc3, =1.0.0, =3.1.0, =3.9.11, =0.6.0, =0.1.0, =0.3.0, =0.8.26, =0.5.0, =0.19.0 and more Source cves: CVE-2026-69112 Source advisory: GHSA-4J2P-28Q2-5M79...

pytorch-clip-interrogator (>=2023.2.19.0, <=2023.2.19.1), stochasticx (>=0.0.14, <=0.0.19) +2 more potentially affected by CVE-2026-69112 via accelerate (0.14.0)

accelerate PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - pytorch-clip-interrogator =2023.2.19.0, =0.0.14, =0.1.0, =0.0.7, =0.0.9 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M7...

pytorch-accelerated (0.1.27) potentially affected by CVE-2026-69112 via accelerate (0.6.0)

accelerate PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - pytorch-accelerated 0.1.27 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

aihandler (>=1.10.3, <=1.15.7), airunner (>=1.11.0, <=1.16.11) +6 more potentially affected by CVE-2026-69112 via accelerate (0.19.0)

accelerate PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - aihandler =1.10.3, =1.11.0, =0.1.0, =0.2.7, =1.3.7, =0.1.0, =0.3.1 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

autotrain-advanced (>=0.7.2, <=0.7.7) potentially affected by CVE-2026-69112 via accelerate (0.27.0)

accelerate PYPI version 0.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - autotrain-advanced =0.7.2, =0.7.7 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...

CVE-2026-69112

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...