Deserialization Of Untrusted Data

huggingface/transformers is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the implementation of TransfoXLTokenizer, which automatically loads the vocab.pkl file from the remote repository using the risky pickle.load function without any restrictions. This issue can ...