Paper/Archive/CVE-2023-6730

CVE-2023-6730

huggingface huggingface/transformers — Deserialization of Untrusted Data in huggingface/transformers

EPSS 0.9%CVSS 9.0

critical.is priorityof 100

39

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 60.6.606 × 2012.1 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Affected

ProductAffectedFixed inSource

huggingface/transformersunspecified – < 4.364.36CNA

Scores by source

@huntr_ai (CNA)9.0CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refhuntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16 refgithub.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce