3m (0.1.0), academic-emotion (0.1.2) +871 more potentially affected by CVE-2024-3568 via transformers (>=4.0.0rc1, <=4.37.2)

transformers PYPI version =4.0.0rc1, =0.1.0, =0.0.3, =0.0.0.dev20230804, =0.3.0, =0.1.0, =0.2.5, =0.1.0, =0.0.1, =0.0.4, =0.0.4, =0.0.11, =0.0.13, =0.0.15, =0.0.21 and more Source cves: CVE-2024-3568 Source advisory: OSV:GHSA-37Q5-V5QM-C9V8...

CVE-2024-3568

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...

CVE-2024-3568 Arbitrary Code Execution via Deserialization in huggingface/transformers

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...

3m (0.1.0), academic-emotion (0.1.2) +962 more potentially affected by CVE-2024-3568 via transformers (>=0.1.0, <=4.37.2)

transformers PYPI version =0.1.0, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.2.0, =0.1.0, =0.2.5, =0.1.0, =0.0.1, =0.0.4, =0.0.4, =0.0.11, =0.0.13, =0.0.20 and more Source cves: CVE-2024-3568 Source advisory: MEND:CVE-2024-3568...

CVE-2024-3568

The CVE-2024-3568 issue affects the Hugging Face Transformers library, where an unsafe deserialization in TFPreTrainedModel.load_repo_checkpoint() uses pickle.load() on data from untrusted sources, enabling remote code execution via a malicious checkpoint. Documented impact targets Transformers v...

CVE-2024-3568

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the "loadrepocheckpoint" function of the "TFPreTrainedModel" class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload,...

CVE-2024-3568 Arbitrary Code Execution via Deserialization in huggingface/transformers

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...

CVE-2024-3568 Arbitrary Code Execution via Deserialization in huggingface/transformers

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...

CVE-2024-3568: Deserialization of Untrusted Data

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the loadrepocheckpoint function of the TFPreTrainedModel class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting...

Hugging Face Transformers code issue vulnerabilities

Hugging Face Transformers is advanced natural language processing for Jax, PyTorch and TensorFlow. A code issue vulnerability exists in Hugging Face Transformers that stems from the ease of executing arbitrary code by deserializing untrusted data in the loadrepocheckpoint function of the...

go-chatgpt (0.0.3), video-transformers (>=0.0.7, <=0.0.9) potentially affected by CVE-2024-2206 via gradio (3.20.1)

gradio PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - go-chatgpt 0.0.3 - video-transformers =0.0.7, =0.0.9 Source cves: CVE-2024-2206 Source advisory: OSV:GHSA-R364-M2J9-MF4H...

go-chatgpt (0.0.3), video-transformers (>=0.0.7, <=0.0.9) potentially affected by CVE-2024-1729 via gradio (3.20.1)

gradio PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - go-chatgpt 0.0.3 - video-transformers =0.0.7, =0.0.9 Source cves: CVE-2024-1729 Source advisory: OSV:GHSA-HMX6-R76C-85G9...

go-chatgpt (0.0.3), video-transformers (>=0.0.7, <=0.0.9) potentially affected by CVE-2024-0964 via gradio (3.20.1)

gradio PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - go-chatgpt 0.0.3 - video-transformers =0.0.7, =0.0.9 Source cves: CVE-2024-0964 Source advisory: OSV:GHSA-F3H9-8PHC-6GVH...

go-chatgpt (0.0.3), video-transformers (>=0.0.7, <=0.0.9) potentially affected by CVE-2023-51449 via gradio (3.20.1)

gradio PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - go-chatgpt 0.0.3 - video-transformers =0.0.7, =0.0.9 Source cves: CVE-2023-51449 Source advisory: OSV:PYSEC-2023-249...

Insecure Deserialization

huggingface transformers is vulnerable to Insecure Deserialization. The vulnerability is due to the ability to load arbitrary pickle files from other repos specified by the indexpath while parsing the remote config.json fille. An attacker can exploit this flaw to execute arbitrary code on the...

go-chatgpt (0.0.3), video-transformers (>=0.0.7, <=0.0.9) potentially affected by CVE-2023-51449 via gradio (3.20.1)

gradio PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - go-chatgpt 0.0.3 - video-transformers =0.0.7, =0.0.9 Source cves: CVE-2023-51449 Source advisory: OSV:GHSA-6QM2-WPXQ-7QH2...

transformers has a Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...

allennlp (>=1.1.0rc1.dev20200710, <=1.1.0), allennlp-models (>=1.1.0rc1, <=1.1.0) +26 more potentially affected by CVE-2023-7018 via transformers (3.0.2)

transformers PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.1.0rc1.dev20200710, =1.1.0rc1, =0.7.1, =0.0.1, =0.1.0, =0.4.6, =1.9.0, =0.0.1.dev0, =0.3.1, =0.1.0, =0.1.3 and more Source...

allennlp (>=1.0.0rc6.dev20200604, <=1.1.0rc1.dev20200709), allennlp-models (>=1.0.0rc6, <=1.1.0rc1.dev20200709) +29 more potentially affected by CVE-2023-7018 via transformers (2.11.0)

transformers PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc6.dev20200604, =1.0.0rc6, =0.0.1rc1, =0.1.2, =0.1.3, =0.5.2, =0.1.2, =3.0.1, =0.1.0, =1.8.0, =0.12.2.dev2, =0.12.2.dev...

adamix-gpt2 (>=0.0.1, <=0.0.2), allennlp (>=1.2.0rc1.dev20200930, <=1.2.0rc1.dev20201021) +6 more potentially affected by CVE-2023-7018 via transformers (3.3.1)

transformers PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adamix-gpt2 =0.0.1, =1.2.0rc1.dev20200930, =1.2.0rc1.dev20201007, =0.0.1, =0.5.0, =0.1.11, =0.1.12 - mc-transformers 0.1.11 Source cves:...