logo

Database

Insecure temporary files In transformers

Description

transformers has Insecure Temporary File Insecure Temporary File in GitHub repository huggingface/transformers 4.29.2 and prior. A fix is available at commit 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 and has been released as part of version 4.30.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-28002. NVD-2023-28003. OSV-2023-28004. GCVE-2023-2800

References

1. https://github.com/huggingface/transformers/pull/233722. https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c433. https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2023-299.yaml4. https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.