PYSEC-2023-300
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-6730
- Alias
- GHSA-3863-2447-669p
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · transformers | introduced 0, fixed 1d63b0ec361e7a38f1339385e8a5a855085532ce ; introduced 0, fixed 4.36.0 |
Références
- https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16 EVIDENCE
- https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce FIX
- https://github.com/advisories/GHSA-3863-2447-669p ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |