Paper/Archive/CVE-2023-7018

CVE-2023-7018

huggingface huggingface/transformers — Deserialization of Untrusted Data in huggingface/transformers

EPSS 0.7%CVSS 9.6

critical.is priorityof 100

40

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 54.4.544 × 2010.9 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Affected

ProductAffectedFixed inSource

huggingface/transformersunspecified – < 4.364.36CNA

Scores by source

@huntr_ai (CNA)9.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

refhuntr.com/bounties/e1a3e548-e53a-48df-b708-9ee62140963c refgithub.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce