allennlp (>=1.2.0rc1.dev20200924, <=1.2.0rc1.dev20200929) potentially affected by CVE-2023-6730 via transformers (3.2.0)

transformers PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20200924, =1.2.0rc1.dev20200929 Source cves: CVE-2023-6730 Source advisory: OSV:PYSEC-2023-300...

adamix-gpt2 (>=0.0.1, <=0.0.2), allennlp (>=1.2.0rc1.dev20200930, <=1.2.0rc1.dev20201021) +6 more potentially affected by CVE-2023-6730 via transformers (3.3.1)

transformers PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adamix-gpt2 =0.0.1, =1.2.0rc1.dev20200930, =1.2.0rc1.dev20201007, =0.0.1, =0.5.0, =0.1.11, =0.1.12 - mc-transformers 0.1.11 Source cves:...

allennlp (>=1.1.0rc1.dev20200710, <=1.1.0), allennlp-models (>=1.1.0rc1, <=1.1.0) +26 more potentially affected by CVE-2023-6730 via transformers (3.0.2)

transformers PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.1.0rc1.dev20200710, =1.1.0rc1, =0.7.1, =0.0.1, =0.1.0, =0.4.6, =1.9.0, =0.0.1.dev0, =0.3.1, =0.1.0, =0.1.3 and more Source...

nlp2go (>=0.2.5, <=0.4.9), nlprep (>=0.1.56, <=0.1.57) +2 more potentially affected by CVE-2023-6730 via transformers (3.3.0)

transformers PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nlp2go =0.2.5, =0.1.56, =0.2.11, =0.4.11, =0.5.13 Source cves: CVE-2023-6730 Source advisory: OSV:PYSEC-2023-300...

sadedegel (>=0.11.3, <=0.18.3), treform (>=1.1.1, <=1.1.3) potentially affected by CVE-2023-6730 via transformers (3.0.0)

transformers PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - sadedegel =0.11.3, =1.1.1, =1.1.3 Source cves: CVE-2023-6730 Source advisory: OSV:PYSEC-2023-300...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2023-6730 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2023-6730 Source advisory: OSV:PYSEC-2023-300...

boolean-question (0.0.3), ernie (0.0.19b0) +6 more potentially affected by CVE-2023-6730 via transformers (2.5.1)

transformers PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - boolean-question 0.0.3 - ernie 0.0.19b0 - methylbert =0.0.2, =0.0.1, =0.0.1a0, =0.1.1, =0.1.19, =0.2.0, =0.2.12 Source cves: CVE-2023-67...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2023-6730 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2023-6730 Source advisory: OSV:PYSEC-2023-300...

allennlp (>=0.9.1.dev20200404, <=0.9.1.dev20200413), pygaggle (0.0.1) potentially affected by CVE-2023-6730 via transformers (2.7.0)

transformers PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200404, =0.9.1.dev20200413 - pygaggle 0.0.1 Source cves: CVE-2023-6730 Source advisory: OSV:PYSEC-2023-300...

PYSEC-2023-300

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...

allennlp (1.2.0rc1.dev20200923), awca (>=0.0.2, <=0.0.3.2) +9 more potentially affected by CVE-2023-6730 via transformers (3.1.0)

transformers PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp 1.2.0rc1.dev20200923 - awca =0.0.2, =0.2.4, =0.4.8, =1.1.1, =1.1.0.dev202009251125, =2.1.0, =1.0.1, =1.1.0 Source cves:...

PYSEC-2023-300

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...

3m (0.1.0), accord-nlp (>=0.1.0, <=0.1.8) +854 more potentially affected by CVE-2023-6730 via transformers (>=0.1.0, <=4.35.2)

transformers PYPI version =0.1.0, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.2.0, =0.1.0, =0.1.0, =0.0.1, =0.0.4, =0.0.4, =0.0.11, =0.0.13, =0.0.15, =1.2.3, =1.3.106 and more Source cves: CVE-2023-6730 Source advisory: MEND:CVE-2023-6730...

CVE-2023-6730 Deserialization of Untrusted Data in huggingface/transformers

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...

CVE-2023-6730

The CVE-2023-6730 issue affects the Hugging Face transformers library and is caused by deserialization of untrusted data in the package prior to version 4.36. Specifically, untrusted input could be deserialized during normal operation of transformers, leading to potential impact as described in t...

CVE-2023-6730

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...

CVE-2023-6730 Deserialization of Untrusted Data in huggingface/transformers

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...

CVE-2023-6730: Deserialization of Untrusted Data

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36...

PT-2023-32753

Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 4.36.0 Description The issue is related to the deserialization of untrusted data in the huggingface/transformers GitHub repository. Recommendations For versions prior to 4.36.0, update to version 4.36...

Hugging Face Transformers Code Issue Vulnerability

Hugging Face Transformers is advanced natural language processing for Jax, PyTorch and TensorFlow. A code issue vulnerability exists in Hugging Face Transformers versions prior to 4.36 that stems from the presence of untrusted data deserialization...