PYSEC-2022-43015
At a glance
- Published
- Updated
- CVE
- CVE-2022-45907
- Aliases
- BIT-pytorch-2022-45907, GHSA-47fc-vmwq-366v
Description
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.
Affected packages
| Package | Versions |
|---|---|
| PyPI · torch | introduced 0, fixed 767f6aa49fe20a2766b9843d01e3b7f7793df6a3 ; introduced 0, fixed 1.13.1 |
References
- https://github.com/pytorch/pytorch/commit/767f6aa49fe20a2766b9843d01e3b7f7793df6a3 FIX
- https://github.com/pytorch/pytorch/issues/88868 EVIDENCE
- https://github.com/pytorch/pytorch/issues/88868 REPORT
- https://github.com/pytorch/pytorch/issues/88868 FIX
- https://github.com/advisories/GHSA-47fc-vmwq-366v ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |