CVE-2023-7018: Deserialization of Untrusted Data in huggingface/transformers
Published Dec 20, 2023
·Updated
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Affected Software
2 affected componentsFixes available
pip/transformers<4.36.0
4.36.0
huggingface transformers<4.36.0
Remediation
Event History
Dec 20, 2023
CVE Published
04:13 PM
Data Sourced
04:13 PM
DescriptionSeverityWeakness
Advisory Published
06:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-7018?
CVE-2023-7018 has been categorized as a medium severity vulnerability due to the potential exploitation of deserialization of untrusted data.
2
How do I fix CVE-2023-7018?
To mitigate CVE-2023-7018, update the huggingface transformers library to version 4.36.0 or later.
3
What is deserialization of untrusted data in CVE-2023-7018?
Deserialization of untrusted data in CVE-2023-7018 refers to the process where untrusted input is processed, potentially leading to arbitrary code execution or data manipulation.
4
Which versions of Huggingface Transformers are affected by CVE-2023-7018?
CVE-2023-7018 affects all versions of Huggingface Transformers prior to 4.36.0.
5
Is CVE-2023-7018 a common vulnerability?
CVE-2023-7018 is notable as deserialization vulnerabilities are frequently found and can lead to serious security issues if not addressed.