CVE-2022-45907: Code Injection
In PyTorch before trunk/89695, torch.jit.annotations.parsetypeline can cause arbitrary code execution because eval is used unsafely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/torchto a version that resolves this vulnerability.Fixed in 1.13.1 - Upgrade
Upgrade
pytorch/torch.jit.annotations.parse_type_lineto a version that resolves this vulnerability.Fixed in 1.13.1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-45907.
What is the severity of CVE-2022-45907?
The severity of CVE-2022-45907 is critical (9.8).
What software versions are affected by CVE-2022-45907?
Versions up to exclusive 1.13.1 of PyTorch are affected by CVE-2022-45907.
How does CVE-2022-45907 occur?
CVE-2022-45907 occurs due to the unsafe use of eval in torch.jit.annotations.parse_type_line.
How can I fix CVE-2022-45907?
To fix CVE-2022-45907, update PyTorch to a version beyond trunk/89695 or apply the necessary patches provided by the PyTorch team.