CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924

The CVE-2024-3924 issue affects hugggingface/text-generation-inference across versions up to 2.0.0 and was fixed in 2.0.0. It stems from insecure handling of github.head_ref in the autodocs.yml workflow, where user input is used to dynamically build a command to install software. An attacker coul...