diff --git a/docs/redesign/phase-9/p9-remed-02/security/ADVISORIES.md b/docs/redesign/phase-9/p9-remed-02/security/ADVISORIES.md new file mode 100644 index 0000000..ecf71eb --- /dev/null +++ b/docs/redesign/phase-9/p9-remed-02/security/ADVISORIES.md @@ -0,0 +1,117 @@ +# Python advisory inventory — P9-REMED-02 + +**BLOCKED** pending selected-model runtime qualification and remaining cache-lock assessment. No owner risk acceptance is asserted. The complete per-advisory ranges, severity/vector, direct/transitive role, actual installed/locked versions, functionality, exposure, fix compatibility, primary sources and required disposition are in [advisory-inventory.json](advisory-inventory.json). + +109 baseline alias groups are not109 independent CVEs. Fresh49-pin before/after queries retain249→99 provider records and109→44 alias groups;65 groups no longer match the updated lock. Some model records describe version/function mismatches; these are preserved with source-limited call-site assessment rather than silently suppressed. + +| Package | Advisory IDs / primary identifier | Current disposition | +| --- | --- | --- | +| certifi | [GHSA-6q48-6c7w-9gw2](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576) (PYSEC-2026-4320) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| filelock | [GHSA-v4x8-3wr5-3wq8](https://github.com/advisories/GHSA-v4x8-3wr5-3wq8) (CVE-2026-112940) | OPEN_LOCAL_CACHE_COMPATIBILITY | +| filelock | [GHSA-9vhv-jxww-xfm5](https://github.com/advisories/GHSA-9vhv-jxww-xfm5) (CVE-2026-112913) | OPEN_LOCAL_CACHE_COMPATIBILITY | +| filelock | [GHSA-567q-5qvw-pf92](https://github.com/advisories/GHSA-567q-5qvw-pf92) (CVE-2026-112907) | OPEN_LOCAL_CACHE_COMPATIBILITY | +| pillow | [GHSA-4558-3h8r-v8xp](https://github.com/advisories/GHSA-4558-3h8r-v8xp) (CVE-2026-112394) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-8g5g-8vmr-9782](https://github.com/advisories/GHSA-8g5g-8vmr-9782) (CVE-2026-112403) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-rfgq-q3w2-pmv2](https://github.com/advisories/GHSA-rfgq-q3w2-pmv2) (CVE-2026-112898) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-xvh5-g6gv-559v](https://github.com/advisories/GHSA-xvh5-g6gv-559v) (CVE-2026-112902) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-p4wg-p73j-c528](https://github.com/advisories/GHSA-p4wg-p73j-c528) (CVE-2026-112895) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-65qm-jvmh-6pqg](https://github.com/advisories/GHSA-65qm-jvmh-6pqg) (CVE-2026-112400) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-58r4-6rv3-gfh8](https://github.com/advisories/GHSA-58r4-6rv3-gfh8) (CVE-2026-112397) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-pchr-8j38-3x4p](https://github.com/advisories/GHSA-pchr-8j38-3x4p) (CVE-2026-112896) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-q45j-58j2-45rg](https://github.com/advisories/GHSA-q45j-58j2-45rg) (CVE-2026-112897) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-462x-pgg6-55fp](https://github.com/advisories/GHSA-462x-pgg6-55fp) (CVE-2026-112395) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-c6hw-5grf-ff96](https://github.com/advisories/GHSA-c6hw-5grf-ff96) (CVE-2026-112404) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-vx6w-vv9f-6gvg](https://github.com/advisories/GHSA-vx6w-vv9f-6gvg) (CVE-2026-112899) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-7mwm-ghpf-9vrm](https://github.com/advisories/GHSA-7mwm-ghpf-9vrm) (CVE-2026-112402) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-w889-685w-c8fh](https://github.com/advisories/GHSA-w889-685w-c8fh) (CVE-2026-112900) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-j4m9-6w36-pw47](https://github.com/advisories/GHSA-j4m9-6w36-pw47) (CVE-2026-112893) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-27h8-gf7j-v5hc](https://github.com/advisories/GHSA-27h8-gf7j-v5hc) (CVE-2026-112392) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-fc9g-5qg7-mf45](https://github.com/advisories/GHSA-fc9g-5qg7-mf45) (CVE-2026-112891) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-cp9v-662q-vvx9](https://github.com/advisories/GHSA-cp9v-662q-vvx9) (CVE-2026-112405) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-22hg-r758-rrw9](https://github.com/advisories/GHSA-22hg-r758-rrw9) (CVE-2026-112390) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-74r2-7ff9-mjj2](https://github.com/advisories/GHSA-74r2-7ff9-mjj2) (CVE-2026-112401) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-xgh8-jp6q-p5x8](https://github.com/advisories/GHSA-xgh8-jp6q-p5x8) (CVE-2026-112901) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-254f-3936-288h](https://github.com/advisories/GHSA-254f-3936-288h) (CVE-2026-112391) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-jg86-v3jv-hrpm](https://github.com/advisories/GHSA-jg86-v3jv-hrpm) (CVE-2026-112894) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-f2g6-542v-9j58](https://github.com/advisories/GHSA-f2g6-542v-9j58) (CVE-2026-112406) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-5xm2-6676-qcp9](https://github.com/advisories/GHSA-5xm2-6676-qcp9) (CVE-2026-112399) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-gg2r-wvfm-q9rx](https://github.com/advisories/GHSA-gg2r-wvfm-q9rx) (CVE-2026-112892) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-332p-7hrc-92wf](https://github.com/advisories/GHSA-332p-7hrc-92wf) (CVE-2026-112393) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-4rr5-89j8-mwwm](https://github.com/advisories/GHSA-4rr5-89j8-mwwm) (CVE-2026-112396) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-24rc-8hj2-v98c](https://github.com/advisories/GHSA-24rc-8hj2-v98c) (CVE-2026-96638) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-4rm8-3hmm-39fg](https://github.com/advisories/GHSA-4rm8-3hmm-39fg) (CVE-2026-96641) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-mrfp-p49p-3hf2](https://github.com/advisories/GHSA-mrfp-p49p-3hf2) (CVE-2026-96640) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-3j72-p6qg-6xp7](https://github.com/advisories/GHSA-3j72-p6qg-6xp7) (CVE-2026-96642) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-v9pv-5gc8-w2m6](https://github.com/advisories/GHSA-v9pv-5gc8-w2m6) (CVE-2026-96639) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-g4qv-2jxx-769h](https://github.com/advisories/GHSA-g4qv-2jxx-769h) (CVE-2026-96643) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-g842-9rc4-69pw](https://github.com/advisories/GHSA-g842-9rc4-69pw) (CVE-2026-96637) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-9v9v-9qvf-h2hj](https://github.com/advisories/GHSA-9v9v-9qvf-h2hj) (CVE-2026-96644) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-g7cr-3p24-7wf7](https://github.com/advisories/GHSA-g7cr-3p24-7wf7) (CVE-2026-96778) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-p8hx-v2p6-rp84](https://github.com/advisories/GHSA-p8hx-v2p6-rp84) (CVE-2026-96636) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-78g4-xqwv-q3g8](https://github.com/advisories/GHSA-78g4-xqwv-q3g8) (no aliases) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-654x-cwwv-5j9c](https://github.com/advisories/GHSA-654x-cwwv-5j9c) (CVE-2026-114501) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pillow | [GHSA-5x8w-8jj5-q52h](https://github.com/advisories/GHSA-5x8w-8jj5-q52h) (CVE-2026-112398) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-5jq2-8x83-x246](https://github.com/advisories/GHSA-5jq2-8x83-x246) (CVE-2026-102994, PYSEC-2026-4153) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-fp3h-c4fm-7vvf](https://github.com/advisories/GHSA-fp3h-c4fm-7vvf) (CVE-2026-102995, PYSEC-2026-4154) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-w23x-9jrw-r45c](https://github.com/advisories/GHSA-w23x-9jrw-r45c) (CVE-2026-103000, PYSEC-2026-4160) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-v247-6f48-mgcj](https://github.com/advisories/GHSA-v247-6f48-mgcj) (CVE-2026-102999, PYSEC-2026-4159) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-jw7q-gvrg-4vj3](https://github.com/advisories/GHSA-jw7q-gvrg-4vj3) (CVE-2026-102997, PYSEC-2026-4156) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-g9cg-prrw-2r8q](https://github.com/advisories/GHSA-g9cg-prrw-2r8q) (CVE-2026-102996, PYSEC-2026-4155) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-qv6h-rv94-w285](https://github.com/advisories/GHSA-qv6h-rv94-w285) (CVE-2026-102993, PYSEC-2026-4158) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-php9-fj8v-98fj](https://github.com/advisories/GHSA-php9-fj8v-98fj) (CVE-2026-102998, PYSEC-2026-4157) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-qfv9-64jg-mh7p](https://github.com/advisories/GHSA-qfv9-64jg-mh7p) (CVE-2026-113792) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-7mh2-4gg2-979f](https://github.com/advisories/GHSA-7mh2-4gg2-979f) (CVE-2026-113795) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-9mx8-4j7g-633p](https://github.com/advisories/GHSA-9mx8-4j7g-633p) (CVE-2026-113793) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-39mj-jf6j-2qj3](https://github.com/advisories/GHSA-39mj-jf6j-2qj3) (CVE-2026-113794) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-5hx5-vpf9-5wcv](https://github.com/advisories/GHSA-5hx5-vpf9-5wcv) (CVE-2026-113786) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-cgf9-327m-v77c](https://github.com/advisories/GHSA-cgf9-327m-v77c) (CVE-2026-113791) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-f54x-cmq8-qg57](https://github.com/advisories/GHSA-f54x-cmq8-qg57) (CVE-2026-113790) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-6vvc-x485-93v7](https://github.com/advisories/GHSA-6vvc-x485-93v7) (CVE-2026-113789) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-6c7f-9265-g8fw](https://github.com/advisories/GHSA-6c7f-9265-g8fw) (CVE-2026-115572) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-jr96-gvgh-j3r4](https://github.com/advisories/GHSA-jr96-gvgh-j3r4) (CVE-2026-115585) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| pypdf | [GHSA-gmh7-3g9r-mjh5](https://github.com/advisories/GHSA-gmh7-3g9r-mjh5) (CVE-2026-115580) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| setuptools | [GHSA-xmj3-9gf7-h52w](https://github.com/advisories/GHSA-xmj3-9gf7-h52w) (no aliases) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| torch | [GHSA-qfhq-4f3w-5fph](https://github.com/advisories/GHSA-qfhq-4f3w-5fph) (BIT-pytorch-2025-3001, CVE-2025-3001, PYSEC-2025-195) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [GHSA-rrmf-rvhw-rf47](https://github.com/advisories/GHSA-rrmf-rvhw-rf47) (BIT-pytorch-2025-3000, CVE-2025-3000, PYSEC-2025-194) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [GHSA-vgrw-7cvw-pwgx](https://github.com/advisories/GHSA-vgrw-7cvw-pwgx) (BIT-pytorch-2025-2999, CVE-2025-2999, PYSEC-2025-193) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [GHSA-3749-ghw9-m3mg](https://github.com/advisories/GHSA-3749-ghw9-m3mg) (BIT-pytorch-2025-2953, CVE-2025-2953, PYSEC-2025-191) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-46148](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46148, PYSEC-2025-198) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-46149](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46149, PYSEC-2025-199) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-46150](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46150, PYSEC-2025-200) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-46152](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46152, PYSEC-2025-201) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-46153](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a) (CVE-2025-46153, PYSEC-2025-202) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-55551](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55551, PYSEC-2025-203) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-55552](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55552, PYSEC-2025-204) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-55553](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55553, PYSEC-2025-205) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-55554](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55554, PYSEC-2025-206) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-55557](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55557, PYSEC-2025-207) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-55558](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55558, PYSEC-2025-208) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2025-55560](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc) (CVE-2025-55560, PYSEC-2025-209) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [BIT-pytorch-2026-4538](https://github.com/pytorch/pytorch/) (CVE-2026-4538, PYSEC-2026-139) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [GHSA-887c-mr87-cxwp](https://github.com/advisories/GHSA-887c-mr87-cxwp) (BIT-pytorch-2025-3730, CVE-2025-3730, PYSEC-2026-1970) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| torch | [GHSA-63cw-57p8-fm3p](https://access.redhat.com/errata/RHSA-2026:24977) (BIT-pytorch-2026-24747, CVE-2026-24747, PYSEC-2026-1856, PYSEC-2026-2286) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14929](https://osv.dev/vulnerability/PYSEC-2025-217) (PYSEC-2025-217) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-qq3j-4f4f-9583](https://github.com/advisories/GHSA-qq3j-4f4f-9583) (CVE-2025-2099, PYSEC-2025-40) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14926](https://osv.dev/vulnerability/PYSEC-2025-214) (PYSEC-2025-214) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14930](https://osv.dev/vulnerability/PYSEC-2025-218) (PYSEC-2025-218) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14920](https://osv.dev/vulnerability/PYSEC-2025-211) (PYSEC-2025-211) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14921](https://osv.dev/vulnerability/PYSEC-2025-212) (PYSEC-2025-212) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14924](https://osv.dev/vulnerability/PYSEC-2025-213) (PYSEC-2025-213) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14927](https://osv.dev/vulnerability/PYSEC-2025-215) (PYSEC-2025-215) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [CVE-2025-14928](https://osv.dev/vulnerability/PYSEC-2025-216) (PYSEC-2025-216) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-37mw-44qp-f5jm](https://github.com/advisories/GHSA-37mw-44qp-f5jm) (CVE-2025-3933, PYSEC-2026-1977) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-59p9-h35m-wg4g](https://github.com/advisories/GHSA-59p9-h35m-wg4g) (CVE-2025-6638, PYSEC-2026-1981) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-jjph-296x-mrcr](https://github.com/advisories/GHSA-jjph-296x-mrcr) (CVE-2025-3264, PYSEC-2026-1985) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-fpwr-67px-3qhx](https://github.com/advisories/GHSA-fpwr-67px-3qhx) (CVE-2025-1194, PYSEC-2026-1984) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-phhr-52qp-3mj4](https://github.com/advisories/GHSA-phhr-52qp-3mj4) (CVE-2025-3777, PYSEC-2026-1986) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-rcv9-qm8p-9p6j](https://github.com/advisories/GHSA-rcv9-qm8p-9p6j) (CVE-2025-6051, PYSEC-2026-1988) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-4w7r-h757-3r74](https://github.com/advisories/GHSA-4w7r-h757-3r74) (CVE-2025-6921, PYSEC-2026-1980) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-q2wp-rjmx-x6x9](https://github.com/advisories/GHSA-q2wp-rjmx-x6x9) (CVE-2025-3263, PYSEC-2026-1987) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-9356-575x-2w9m](https://github.com/advisories/GHSA-9356-575x-2w9m) (CVE-2025-5197, PYSEC-2026-1983) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-69w3-r845-3855](https://github.com/advisories/GHSA-69w3-r845-3855) (CVE-2026-1839, PYSEC-2026-2288) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-29pf-2h5f-8g72](https://github.com/advisories/GHSA-29pf-2h5f-8g72) (CVE-2026-4372, PYSEC-2026-2289) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-fgcw-684q-jj6r](https://access.redhat.com/errata/RHSA-2026:34456) (CVE-2026-5241, PYSEC-2026-2290) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| transformers | [GHSA-xrqw-3rrv-vx5w](https://github.com/advisories/GHSA-xrqw-3rrv-vx5w) (CVE-2026-9856, PYSEC-2026-3929) | BLOCKED_MODEL_RUNTIME_QUALIFICATION | +| urllib3 | [GHSA-vxq7-64xx-v4gw](https://github.com/advisories/GHSA-vxq7-64xx-v4gw) (CVE-2026-97689, PYSEC-2026-4177) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| urllib3 | [GHSA-gh4c-6fx4-qh6g](https://github.com/advisories/GHSA-gh4c-6fx4-qh6g) (CVE-2026-97688, PYSEC-2026-4176) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | +| urllib3 | [GHSA-8988-9cw3-xx77](https://github.com/advisories/GHSA-8988-9cw3-xx77) (CVE-2026-97687, PYSEC-2026-4175) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS | diff --git a/docs/redesign/phase-9/p9-remed-02/security/REMEDIATION.md b/docs/redesign/phase-9/p9-remed-02/security/REMEDIATION.md new file mode 100644 index 0000000..fe62f46 --- /dev/null +++ b/docs/redesign/phase-9/p9-remed-02/security/REMEDIATION.md @@ -0,0 +1,50 @@ +# Python security remediation — 24 October 2026 + +**Verdict: BLOCKED for remaining model-runtime qualification; no owner risk acceptance.** Five bounded dependency upgrades remove65 of109 baseline advisory alias groups from the locked graph. Remaining44 groups are recorded individually, not suppressed. This is local development evidence, not a deployed fix. + +## Exact changes and reproducibility + +| Package | Before | After | Selection and compatibility | +| --- | --- | --- | --- | +| Pillow |12.3.0 |13.0.0 |Published parser fixes include JPEG/APNG/EXIF paths. Python3.12 is supported; removed APIs were checked against the actual Image.open/convert/OCR call sites. No removed API is called by the sidecar. | +| pypdf |6.16.2 |6.21.2 |Latest reviewed6.x security patch; PdfReader/pages/extract_text contract retained and benign PDF content checked. | +| certifi |2026.7.22 |2026.10.19 |Removes affected compromised CA trust; transitive Requests/Hugging Face use. | +| urllib3 |2.7.0 |2.8.0 |Patched proxy/chunk/deflate handling; no service routing/API changes. | +| setuptools |84.0.0 |84.1.0 |Patched legacy wheel/namespace installation path. Runtime performs no package installation. | + +Primary upstream evidence: [Pillow13 security and compatibility notes](https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html), [pypdf6.21.2 changelog](https://pypdf.readthedocs.io/en/stable/meta/CHANGELOG.html), [certifi advisory](https://github.com/advisories/GHSA-6q48-6c7w-9gw2). All per-advisory primary links, exact affected ranges, published fix events and severity labels are retained in [the inventory](advisory-inventory.json). + +The existing UV0.12.7 Linux hash-lock command was reused with Python3.12/x86_64 Linux and the CPU Torch index. Exactly five versions changed among49 pins; no other package/version was added, removed or upgraded. `requirements.txt` declares the three previously transitive TLS/build pins explicitly as reviewed security constraints. The hash lock contains actual distribution hashes; five downloaded Linuxcp312 wheels were independently hashed and matched against it. No Torch or model artifact was downloaded. Existing application source, models, parser limits, API, withholding policy and production Dockerfile are unchanged. + +Reproduce from `tools/summarizer` using the installed UV runtime: + +```powershell +rtk proxy .venv/Scripts/python.exe -m uv pip compile requirements.txt --generate-hashes --python-version 3.12 --python-platform x86_64-unknown-linux-gnu --torch-backend cpu --output-file requirements-linux.lock +rtk proxy .venv/Scripts/python.exe -m pytest -q tests +rtk proxy .venv/Scripts/python.exe -m pip check +``` + +Keep an original lock copy and compare exact membership before replacing it. Regeneration reuses current lock pins; a clean resolution without that output may choose different transitive versions. Production installs continue to require hashes from the committed lock. Local Windows validation installed only the five exact changes without resolving unrelated dependencies and `pip check` passes. + +## Regression evidence + +- Baseline bounded APNG regression:1 failed/1 passed. A64-pixel synthetic APNG demonstrably allocated the full rejected canvas before the decompression-bomb check on Pillow12.3.0; no large/malicious allocation was attempted. This directly covers GHSA-5xm2-6676-qcp9's operation ordering. +- Patched complete sidecar suite: **58/58 passed**, zero skipped, comprising56 existing cases plus2 added parser-security cases. The second truncated-xref case already passed on the old pypdf pin; it is not claimed as a RED reproduction of that pin. A five-second child deadline prevents an unbounded regression hang. +- Real local uvicorn startup: health reports model disabled/unloaded and unavailable local summarization. Actual token-protected uploads of synthetic TXT/DOCX/PDF preserve content including `Åse Østby ærlig` and `Python and C#`; missing-token upload returns401. The owned process is stopped afterward. This uses actual HTTP and parser children, not an AI model. +- Supplemental **Linux Python3.12.10 parser** check:2/2 added regressions pass plus3/3 actual resource-bounded child TXT/DOCX/PDF decodes preserving the same content. It runs nonroot in a read-only, network-none, capability-dropped container with512MiB/oneCPU limits; no daemon socket, host port or persistent data. The container is removed. Pytest emits one `cache_dir` warning because its cache plugin is disabled; no case is skipped or retried. + +The supplemental Linux image contains the exact reviewed parser/TLS changes and small test dependencies; it is **not** the complete49-package sidecar graph and runs no OCR/model inference. Its image/source/process identities are in validation.json. An existing cached sidecar image was inspected and found to use Python3.11.16/FastAPI0.115.12/Pillow11.1/pypdf5.4; it was not relabelled as the current3.12 hash-lock runtime. + +Raw logs, TRX-equivalent JUnit, before/after queries, source identities and synthetic originals remain under `.artifacts/p9-remed-02/security/`. Focused/supplemental checks are not added to the complete58 total. + +## Fresh advisory accounting and remaining actions + +Fresh exact OSV/PyPI queries:49 pins,98 requests before and98 after; each has97 successes and one retained PyPI404 for vendor version `torch==2.6.0+cpu`. Exact OSV CPU-version lookup succeeds. The missing PyPI vendor release is explained but remains an incomplete second-provider result; no upstream-version substitution is represented as exact vendor coverage. + +Before:249 provider records,109 published alias groups across8 packages. After:99 records,44 groups across3 packages — filelock3, Torch19, Transformers22.65 groups no longer match the updated exact lock. Alias groups are not independent CVE or exploit counts. [ADVISORIES.md](ADVISORIES.md) indexes every baseline group and its current disposition; [JSON](advisory-inventory.json) retains all mandatory per-row fields. + +Filelock4 changes some shared-cache/on-disk lock protocols; the inspected Hugging Face helper uses FileLock with a SoftFileLock fallback, not ReadWriteLock. No runtime/cache migration was attempted. The Windows fallback/local-marker condition still needs a narrow compatibility/ownership assessment. Read the [upstream protocol warning](https://py-filelock.readthedocs.io/en/latest/changelog.html#id162) before a shared-cache transition; no live cache participant may be silently mixed. + +Torch/Transformers records include many alternative model, conversion, Trainer, optimizer and compiler operations with no matching application call found. Those absences are explicitly source-limited. Fixed-repository `from_pretrained` loading still exists without an immutable revision/artifact integrity record; actual checkpoint format and model dependency internals remain unqualified. The standard user cache contained no DistilBART snapshot, and no model download/inference was attempted. Some provider records describe other library versions/model families; the inventory retains those ranges and does not assert a reproduced exploit in this application. + +Next security action: select and validate a compatible patched Torch/Transformers CPU graph for the existing model, verify immutable model/tokenizer/checkpoint identities, startup and representative inference/extraction contracts in an approved local environment. Alternatively, the product/security owner must explicitly decide any serious residual risk after applicability evidence. This task does not accept it for them. Container isolation, resource limits and mocked inference tests do not close that gate. Bootstrap pip/wheel, base OS/OCR libraries and actual production identities remain separate release audit obligations. diff --git a/docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json b/docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json new file mode 100644 index 0000000..647f68c --- /dev/null +++ b/docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json @@ -0,0 +1,23361 @@ +{ + "schemaVersion": 1, + "generatedUtc": "2026-10-24T17:06:41.404948+00:00", + "gate": "BLOCKED", + "riskAcceptedByOwner": false, + "baselineLockSha256": "36f2912965d183e59f2d8320f3817ca8dd0fee6d76e05cfd63ac92defe6c6031", + "currentLockSha256": "23f200fef330e2677ff4a47e5fcbaa327f98c3d4ebdcf73e2047e9f61664e7cb", + "exactPins": 49, + "before": { + "providerRecords": 249, + "aliasGroups": 109, + "packages": 8 + }, + "after": { + "providerRecords": 99, + "aliasGroups": 44, + "packages": 3 + }, + "remediatedAliasGroups": 65, + "coverage": "OSV exact vendor CPU version succeeds; PyPI exact2.6.0+cpu404 retained. Incomplete dual-provider vendor coverage, not silently substituted.", + "sourceScope": "Windows local full sidecar58 tests and disabled-model HTTP startup; Linux3.12 hash-locked wheel identities checked. Production/built image/model inference not qualified.", + "changes": { + "pypdf": { + "before": "6.16.2", + "after": "6.21.2" + }, + "urllib3": { + "before": "2.7.0", + "after": "2.8.0" + }, + "setuptools": { + "before": "84.0.0", + "after": "84.1.0" + }, + "pillow": { + "before": "12.3.0", + "after": "13.0.0" + }, + "certifi": { + "before": "2026.7.22", + "after": "2026.10.19" + } + }, + "advisories": [ + { + "package": "certifi", + "baselineLockedVersion": "2026.7.22", + "currentLockedVersion": "2026.10.19", + "observedCurrentWindowsInstalledVersion": "2026.10.19", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "security-constrained transitive dependency", + "identifiers": [ + "GHSA-6q48-6c7w-9gw2", + "PYSEC-2026-4320" + ], + "summary": "certifi bundles emSign root CAs with compromised intermediate CA keys", + "publishedSeverityLabels": [ + "CRITICAL" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-6q48-6c7w-9gw2", + "affected": [ + { + "package": { + "name": "certifi", + "ecosystem": "PyPI", + "purl": "pkg:pypi/certifi" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2019.03.09" + }, + { + "fixed": "2026.10.19" + } + ] + } + ], + "versions": [ + "2019.11.28", + "2019.3.9", + "2019.6.16", + "2019.9.11", + "2020.11.8", + "2020.12.5", + "2020.4.5", + "2020.4.5.1", + "2020.4.5.2", + "2020.6.20", + "2021.10.8", + "2021.5.30", + "2022.12.7", + "2022.5.18", + "2022.5.18.1", + "2022.6.15", + "2022.6.15.1", + "2022.6.15.2", + "2022.9.14", + "2022.9.24", + "2023.11.17", + "2023.5.7", + "2023.7.22", + "2024.12.14", + "2024.2.2", + "2024.6.2", + "2024.7.4", + "2024.8.30", + "2025.1.31", + "2025.10.5", + "2025.11.12", + "2025.4.26", + "2025.6.15", + "2025.7.14", + "2025.7.9", + "2025.8.3", + "2026.1.4", + "2026.10.18", + "2026.2.25", + "2026.4.22", + "2026.5.20", + "2026.6.17", + "2026.7.22" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6q48-6c7w-9gw2/GHSA-6q48-6c7w-9gw2.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4320", + "affected": [ + { + "package": { + "name": "certifi", + "ecosystem": "PyPI", + "purl": "pkg:pypi/certifi" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2019.03.09" + }, + { + "fixed": "2026.10.19" + } + ] + } + ], + "versions": [ + "2019.11.28", + "2019.3.9", + "2019.6.16", + "2019.9.11", + "2020.11.8", + "2020.12.5", + "2020.4.5", + "2020.4.5.1", + "2020.4.5.2", + "2020.6.20", + "2021.10.8", + "2021.5.30", + "2022.12.7", + "2022.5.18", + "2022.5.18.1", + "2022.6.15", + "2022.6.15.1", + "2022.6.15.2", + "2022.9.14", + "2022.9.24", + "2023.11.17", + "2023.5.7", + "2023.7.22", + "2024.12.14", + "2024.2.2", + "2024.6.2", + "2024.7.4", + "2024.8.30", + "2025.1.31", + "2025.10.5", + "2025.11.12", + "2025.4.26", + "2025.6.15", + "2025.7.14", + "2025.7.9", + "2025.8.3", + "2026.1.4", + "2026.10.18", + "2026.2.25", + "2026.4.22", + "2026.5.20", + "2026.6.17", + "2026.7.22" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/certifi/PYSEC-2026-4320.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2026.10.19" + ], + "vulnerableFunctionality": "certifi bundles emSign root CAs with compromised intermediate CA keys", + "reachabilityAssessment": "POTENTIALLY REACHABLE: Requests/Hugging Face TLS trust uses the CA bundle on model/dependency fetches; an on-path attacker plus compromised CA is required. No interception reproduced.", + "untrustedExposure": "Outbound TLS; users cannot supply model repository through the public upload API.", + "availableFixDecision": "2026.10.19 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", + "https://emudhra.we-have-a-problem.com", + "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", + "https://github.com/certifi/python-certifi", + "https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2", + "https://osv.dev/vulnerability/GHSA-6q48-6c7w-9gw2", + "https://osv.dev/vulnerability/PYSEC-2026-4320", + "https://pypi.org/project/certifi" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "filelock", + "baselineLockedVersion": "3.32.4", + "currentLockedVersion": "3.32.4", + "observedCurrentWindowsInstalledVersion": "3.32.4", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "transitive dependency", + "identifiers": [ + "CVE-2026-112940", + "GHSA-v4x8-3wr5-3wq8" + ], + "summary": "filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-v4x8-3wr5-3wq8", + "affected": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.20.4" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.20.4", + "3.21.0", + "3.21.1", + "3.21.2", + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v4x8-3wr5-3wq8/GHSA-v4x8-3wr5-3wq8.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.2.1" + ], + "vulnerableFunctionality": "filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files", + "reachabilityAssessment": "NO APPLICATION CALL FOUND for ReadWriteLock: application and installed Hugging Face cache helper use FileLock with SoftFileLock fallback. This is a source-limited absence, not blanket ecosystem acceptance.", + "untrustedExposure": "Local lock-directory attacker/shared cache prerequisites; no direct uploaded-file or HTTP lock-path control found.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-v4x8-3wr5-3wq8", + "https://github.com/tox-dev/filelock", + "https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d", + "https://github.com/tox-dev/filelock/pull/834", + "https://github.com/tox-dev/filelock/releases/tag/4.2.1", + "https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112940", + "https://osv.dev/vulnerability/GHSA-v4x8-3wr5-3wq8" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "OPEN_LOCAL_CACHE_COMPATIBILITY", + "requiredAction": "Dependency owner: verify filelock4/Hugging Face lock and shared-cache compatibility, private cache ownership and all-participant transition before upgrade or explicit narrow disposition." + }, + { + "package": "filelock", + "baselineLockedVersion": "3.32.4", + "currentLockedVersion": "3.32.4", + "observedCurrentWindowsInstalledVersion": "3.32.4", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "transitive dependency", + "identifiers": [ + "CVE-2026-112913", + "GHSA-9vhv-jxww-xfm5" + ], + "summary": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-9vhv-jxww-xfm5", + "affected": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.20.4" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.20.4", + "3.21.0", + "3.21.1", + "3.21.2", + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9vhv-jxww-xfm5/GHSA-9vhv-jxww-xfm5.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.2.1" + ], + "vulnerableFunctionality": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", + "reachabilityAssessment": "NO APPLICATION CALL FOUND for ReadWriteLock: application and installed Hugging Face cache helper use FileLock with SoftFileLock fallback. This is a source-limited absence, not blanket ecosystem acceptance.", + "untrustedExposure": "Local lock-directory attacker/shared cache prerequisites; no direct uploaded-file or HTTP lock-path control found.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-9vhv-jxww-xfm5", + "https://github.com/tox-dev/filelock", + "https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d", + "https://github.com/tox-dev/filelock/pull/834", + "https://github.com/tox-dev/filelock/releases/tag/4.2.1", + "https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5", + "https://osv.dev/vulnerability/GHSA-9vhv-jxww-xfm5" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "OPEN_LOCAL_CACHE_COMPATIBILITY", + "requiredAction": "Dependency owner: verify filelock4/Hugging Face lock and shared-cache compatibility, private cache ownership and all-participant transition before upgrade or explicit narrow disposition." + }, + { + "package": "filelock", + "baselineLockedVersion": "3.32.4", + "currentLockedVersion": "3.32.4", + "observedCurrentWindowsInstalledVersion": "3.32.4", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "transitive dependency", + "identifiers": [ + "CVE-2026-112907", + "GHSA-567q-5qvw-pf92" + ], + "summary": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-567q-5qvw-pf92", + "affected": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.22.0" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-567q-5qvw-pf92/GHSA-567q-5qvw-pf92.json", + "last_known_affected_version_range": "<= 4.2.0" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.2.1" + ], + "vulnerableFunctionality": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", + "reachabilityAssessment": "CONDITIONAL LOCAL PATH: Hugging Face WeakFileLock can fall back to SoftFileLock when flock is unsupported. The Windows oplock timeout condition therefore cannot be dismissed for all supported development configurations.", + "untrustedExposure": "Local actor able to manipulate the cache lock marker; configured filesystem and cache sharing unverified.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-567q-5qvw-pf92", + "https://github.com/tox-dev/filelock", + "https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a", + "https://github.com/tox-dev/filelock/pull/835", + "https://github.com/tox-dev/filelock/releases/tag/4.2.1", + "https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92", + "https://osv.dev/vulnerability/GHSA-567q-5qvw-pf92" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "OPEN_LOCAL_CACHE_COMPATIBILITY", + "requiredAction": "Dependency owner: verify filelock4/Hugging Face lock and shared-cache compatibility, private cache ownership and all-participant transition before upgrade or explicit narrow disposition." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112394", + "GHSA-4558-3h8r-v8xp" + ], + "summary": "Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-4558-3h8r-v8xp", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4558-3h8r-v8xp/GHSA-4558-3h8r-v8xp.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-4558-3h8r-v8xp", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31", + "https://github.com/python-pillow/Pillow/pull/9723", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112394" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112403", + "GHSA-8g5g-8vmr-9782" + ], + "summary": "Pillow: Heap buffer overflow in ImagingJpegDecode", + "publishedSeverityLabels": [ + "CRITICAL" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-8g5g-8vmr-9782", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-8g5g-8vmr-9782/GHSA-8g5g-8vmr-9782.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Heap buffer overflow in ImagingJpegDecode", + "reachabilityAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", + "untrustedExposure": "Untrusted image uploads, plus rasterized PDF OCR images.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-8g5g-8vmr-9782", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112403" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112898", + "GHSA-rfgq-q3w2-pmv2" + ], + "summary": "Pillow: Image.quantize() with empty palette leaks uninitialized stack memory", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-rfgq-q3w2-pmv2", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rfgq-q3w2-pmv2/GHSA-rfgq-q3w2-pmv2.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Image.quantize() with empty palette leaks uninitialized stack memory", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-rfgq-q3w2-pmv2", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-rfgq-q3w2-pmv2", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112898" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112902", + "GHSA-xvh5-g6gv-559v" + ], + "summary": " Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-xvh5-g6gv-559v", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xvh5-g6gv-559v/GHSA-xvh5-g6gv-559v.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": " Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-xvh5-g6gv-559v", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112895", + "GHSA-p4wg-p73j-c528" + ], + "summary": "Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-p4wg-p73j-c528", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p4wg-p73j-c528/GHSA-p4wg-p73j-c528.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-p4wg-p73j-c528", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112895", + "https://osv.dev/vulnerability/GHSA-p4wg-p73j-c528" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112400", + "GHSA-65qm-jvmh-6pqg" + ], + "summary": "Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-65qm-jvmh-6pqg", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-65qm-jvmh-6pqg/GHSA-65qm-jvmh-6pqg.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-65qm-jvmh-6pqg", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112400", + "https://osv.dev/vulnerability/GHSA-65qm-jvmh-6pqg" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112397", + "GHSA-58r4-6rv3-gfh8" + ], + "summary": "Pillow: Out-of-bounds access in _imagingmorph on a zero-width image", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-58r4-6rv3-gfh8", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-58r4-6rv3-gfh8/GHSA-58r4-6rv3-gfh8.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Out-of-bounds access in _imagingmorph on a zero-width image", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-58r4-6rv3-gfh8", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112397", + "https://osv.dev/vulnerability/GHSA-58r4-6rv3-gfh8" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112896", + "GHSA-pchr-8j38-3x4p" + ], + "summary": "Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-pchr-8j38-3x4p", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-pchr-8j38-3x4p/GHSA-pchr-8j38-3x4p.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-pchr-8j38-3x4p", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112896", + "https://osv.dev/vulnerability/GHSA-pchr-8j38-3x4p" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112897", + "GHSA-q45j-58j2-45rg" + ], + "summary": "Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-q45j-58j2-45rg", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.3.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q45j-58j2-45rg/GHSA-q45j-58j2-45rg.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-q45j-58j2-45rg", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112897", + "https://osv.dev/vulnerability/GHSA-q45j-58j2-45rg" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112395", + "GHSA-462x-pgg6-55fp" + ], + "summary": "Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-462x-pgg6-55fp", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.2.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-462x-pgg6-55fp/GHSA-462x-pgg6-55fp.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-462x-pgg6-55fp", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112395", + "https://osv.dev/vulnerability/GHSA-462x-pgg6-55fp" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112404", + "GHSA-c6hw-5grf-ff96" + ], + "summary": "Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-c6hw-5grf-ff96", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-c6hw-5grf-ff96/GHSA-c6hw-5grf-ff96.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-c6hw-5grf-ff96", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112404", + "https://osv.dev/vulnerability/GHSA-c6hw-5grf-ff96" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112899", + "GHSA-vx6w-vv9f-6gvg" + ], + "summary": "Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-vx6w-vv9f-6gvg", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vx6w-vv9f-6gvg/GHSA-vx6w-vv9f-6gvg.json", + "last_known_affected_version_range": "<= 12.3.0" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-vx6w-vv9f-6gvg", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/3e8cc105588d1dfe062fcada0b6058c1b5f14b65", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vx6w-vv9f-6gvg", + "https://osv.dev/vulnerability/GHSA-vx6w-vv9f-6gvg" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112402", + "GHSA-7mwm-ghpf-9vrm" + ], + "summary": "Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-7mwm-ghpf-9vrm", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7mwm-ghpf-9vrm/GHSA-7mwm-ghpf-9vrm.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-7mwm-ghpf-9vrm", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112402", + "https://osv.dev/vulnerability/GHSA-7mwm-ghpf-9vrm" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112900", + "GHSA-w889-685w-c8fh" + ], + "summary": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", + "publishedSeverityLabels": [ + "CRITICAL" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-w889-685w-c8fh", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-w889-685w-c8fh/GHSA-w889-685w-c8fh.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-w889-685w-c8fh", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112900", + "https://osv.dev/vulnerability/GHSA-w889-685w-c8fh" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112893", + "GHSA-j4m9-6w36-pw47" + ], + "summary": "Pillow: Invalid free in FreeType glyph rendering when a stroker is active", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-j4m9-6w36-pw47", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.0.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j4m9-6w36-pw47/GHSA-j4m9-6w36-pw47.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Invalid free in FreeType glyph rendering when a stroker is active", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-j4m9-6w36-pw47", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112893", + "https://osv.dev/vulnerability/GHSA-j4m9-6w36-pw47" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112392", + "GHSA-27h8-gf7j-v5hc" + ], + "summary": "Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-27h8-gf7j-v5hc", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-27h8-gf7j-v5hc/GHSA-27h8-gf7j-v5hc.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-27h8-gf7j-v5hc", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112392", + "https://osv.dev/vulnerability/GHSA-27h8-gf7j-v5hc" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112891", + "GHSA-fc9g-5qg7-mf45" + ], + "summary": "Pillow: Quadratic GIF comment copying during save", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-fc9g-5qg7-mf45", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.2.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fc9g-5qg7-mf45/GHSA-fc9g-5qg7-mf45.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Quadratic GIF comment copying during save", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-fc9g-5qg7-mf45", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112891", + "https://osv.dev/vulnerability/GHSA-fc9g-5qg7-mf45" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112405", + "GHSA-cp9v-662q-vvx9" + ], + "summary": "Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-cp9v-662q-vvx9", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "12.0.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cp9v-662q-vvx9/GHSA-cp9v-662q-vvx9.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-cp9v-662q-vvx9", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112405", + "https://osv.dev/vulnerability/GHSA-cp9v-662q-vvx9" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112390", + "GHSA-22hg-r758-rrw9" + ], + "summary": "Pillow: Infinite loop in MIC n_frames when the embedded TIFF", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-22hg-r758-rrw9", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-22hg-r758-rrw9/GHSA-22hg-r758-rrw9.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Infinite loop in MIC n_frames when the embedded TIFF", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-22hg-r758-rrw9", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112390", + "https://osv.dev/vulnerability/GHSA-22hg-r758-rrw9" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112401", + "GHSA-74r2-7ff9-mjj2" + ], + "summary": "Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-74r2-7ff9-mjj2", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.4.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "5.4.0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-74r2-7ff9-mjj2/GHSA-74r2-7ff9-mjj2.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-74r2-7ff9-mjj2", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112401", + "https://osv.dev/vulnerability/GHSA-74r2-7ff9-mjj2" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112901", + "GHSA-xgh8-jp6q-p5x8" + ], + "summary": "Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-xgh8-jp6q-p5x8", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xgh8-jp6q-p5x8/GHSA-xgh8-jp6q-p5x8.json", + "last_known_affected_version_range": "<= 12.3.0" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-xgh8-jp6q-p5x8", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/2852a3e3d568997ddec745fc800991f138878f4b", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xgh8-jp6q-p5x8", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112901", + "https://osv.dev/vulnerability/GHSA-xgh8-jp6q-p5x8" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112391", + "GHSA-254f-3936-288h" + ], + "summary": "Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-254f-3936-288h", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-254f-3936-288h/GHSA-254f-3936-288h.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-254f-3936-288h", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112391", + "https://osv.dev/vulnerability/GHSA-254f-3936-288h" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112894", + "GHSA-jg86-v3jv-hrpm" + ], + "summary": "Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-jg86-v3jv-hrpm", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jg86-v3jv-hrpm/GHSA-jg86-v3jv-hrpm.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-jg86-v3jv-hrpm", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112894", + "https://osv.dev/vulnerability/GHSA-jg86-v3jv-hrpm" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112406", + "GHSA-f2g6-542v-9j58" + ], + "summary": "Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-f2g6-542v-9j58", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f2g6-542v-9j58/GHSA-f2g6-542v-9j58.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-f2g6-542v-9j58", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112406", + "https://osv.dev/vulnerability/GHSA-f2g6-542v-9j58" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112399", + "GHSA-5xm2-6676-qcp9" + ], + "summary": "Pillow: APNG background disposal allocates full canvas before decompression bomb check", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-5xm2-6676-qcp9", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5xm2-6676-qcp9/GHSA-5xm2-6676-qcp9.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: APNG background disposal allocates full canvas before decompression bomb check", + "reachabilityAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", + "untrustedExposure": "Untrusted image uploads, plus rasterized PDF OCR images.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-5xm2-6676-qcp9", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112399", + "https://osv.dev/vulnerability/GHSA-5xm2-6676-qcp9" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112892", + "GHSA-gg2r-wvfm-q9rx" + ], + "summary": "Pillow: MSP RLE decoder expands a tiny file into unbounded memory", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-gg2r-wvfm-q9rx", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gg2r-wvfm-q9rx/GHSA-gg2r-wvfm-q9rx.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: MSP RLE decoder expands a tiny file into unbounded memory", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-gg2r-wvfm-q9rx", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112892", + "https://osv.dev/vulnerability/GHSA-gg2r-wvfm-q9rx" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112393", + "GHSA-332p-7hrc-92wf" + ], + "summary": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", + "publishedSeverityLabels": [ + "CRITICAL" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-332p-7hrc-92wf", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-332p-7hrc-92wf/GHSA-332p-7hrc-92wf.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-332p-7hrc-92wf", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112393", + "https://osv.dev/vulnerability/GHSA-332p-7hrc-92wf" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112396", + "GHSA-4rr5-89j8-mwwm" + ], + "summary": "Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-4rr5-89j8-mwwm", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.3.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4rr5-89j8-mwwm/GHSA-4rr5-89j8-mwwm.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-4rr5-89j8-mwwm", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/dc95da20207827a062cfbf551ee9f6031465a8bb", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rr5-89j8-mwwm", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112396", + "https://osv.dev/vulnerability/GHSA-4rr5-89j8-mwwm" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96638", + "GHSA-24rc-8hj2-v98c" + ], + "summary": "Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-24rc-8hj2-v98c", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-24rc-8hj2-v98c/GHSA-24rc-8hj2-v98c.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-24rc-8hj2-v98c", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9a", + "https://github.com/python-pillow/Pillow/pull/10015", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98c", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96638", + "https://osv.dev/vulnerability/GHSA-24rc-8hj2-v98c" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96641", + "GHSA-4rm8-3hmm-39fg" + ], + "summary": "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-4rm8-3hmm-39fg", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4rm8-3hmm-39fg/GHSA-4rm8-3hmm-39fg.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-4rm8-3hmm-39fg", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4", + "https://github.com/python-pillow/Pillow/pull/10010", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96641", + "https://osv.dev/vulnerability/GHSA-4rm8-3hmm-39fg" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96640", + "GHSA-mrfp-p49p-3hf2" + ], + "summary": "Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-mrfp-p49p-3hf2", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-mrfp-p49p-3hf2/GHSA-mrfp-p49p-3hf2.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-mrfp-p49p-3hf2", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7", + "https://github.com/python-pillow/Pillow/pull/10093", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96640", + "https://osv.dev/vulnerability/GHSA-mrfp-p49p-3hf2" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96642", + "GHSA-3j72-p6qg-6xp7" + ], + "summary": "Pillow: TarIO negative size field causes infinite CPU-spin loop", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-3j72-p6qg-6xp7", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3j72-p6qg-6xp7/GHSA-3j72-p6qg-6xp7.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: TarIO negative size field causes infinite CPU-spin loop", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-3j72-p6qg-6xp7", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d", + "https://github.com/python-pillow/Pillow/pull/10012", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96642", + "https://osv.dev/vulnerability/GHSA-3j72-p6qg-6xp7" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96639", + "GHSA-v9pv-5gc8-w2m6" + ], + "summary": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions", + "publishedSeverityLabels": [ + "CRITICAL" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-v9pv-5gc8-w2m6", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v9pv-5gc8-w2m6/GHSA-v9pv-5gc8-w2m6.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-v9pv-5gc8-w2m6", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a", + "https://github.com/python-pillow/Pillow/pull/10105", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96639", + "https://osv.dev/vulnerability/GHSA-v9pv-5gc8-w2m6" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96643", + "GHSA-g4qv-2jxx-769h" + ], + "summary": "Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-g4qv-2jxx-769h", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g4qv-2jxx-769h/GHSA-g4qv-2jxx-769h.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time", + "reachabilityAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", + "untrustedExposure": "Untrusted image uploads, plus rasterized PDF OCR images.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-g4qv-2jxx-769h", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c", + "https://github.com/python-pillow/Pillow/pull/10073", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96643", + "https://osv.dev/vulnerability/GHSA-g4qv-2jxx-769h" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96637", + "GHSA-g842-9rc4-69pw" + ], + "summary": "Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-g842-9rc4-69pw", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g842-9rc4-69pw/GHSA-g842-9rc4-69pw.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-g842-9rc4-69pw", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841", + "https://github.com/python-pillow/Pillow/pull/10076", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96637", + "https://osv.dev/vulnerability/GHSA-g842-9rc4-69pw" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96644", + "GHSA-9v9v-9qvf-h2hj" + ], + "summary": "Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-9v9v-9qvf-h2hj", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9v9v-9qvf-h2hj/GHSA-9v9v-9qvf-h2hj.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-9v9v-9qvf-h2hj", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7", + "https://github.com/python-pillow/Pillow/pull/10120", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96644", + "https://osv.dev/vulnerability/GHSA-9v9v-9qvf-h2hj" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96778", + "GHSA-g7cr-3p24-7wf7" + ], + "summary": "Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-g7cr-3p24-7wf7", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.4.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g7cr-3p24-7wf7/GHSA-g7cr-3p24-7wf7.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-g7cr-3p24-7wf7", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b", + "https://github.com/python-pillow/Pillow/pull/10124", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96778", + "https://osv.dev/vulnerability/GHSA-g7cr-3p24-7wf7" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-96636", + "GHSA-p8hx-v2p6-rp84" + ], + "summary": "Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-p8hx-v2p6-rp84", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p8hx-v2p6-rp84/GHSA-p8hx-v2p6-rp84.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-p8hx-v2p6-rp84", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48", + "https://github.com/python-pillow/Pillow/pull/10011", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p8hx-v2p6-rp84", + "https://nvd.nist.gov/vuln/detail/CVE-2026-96636", + "https://osv.dev/vulnerability/GHSA-p8hx-v2p6-rp84" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "GHSA-78g4-xqwv-q3g8" + ], + "summary": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-78g4-xqwv-q3g8", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-78g4-xqwv-q3g8/GHSA-78g4-xqwv-q3g8.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()", + "reachabilityAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", + "untrustedExposure": "Untrusted image bytes; generated PNG in PDF OCR. Package-wide upgrade removes the matched vulnerable version without dismissing per-format risks.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-78g4-xqwv-q3g8", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc", + "https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8", + "https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad", + "https://osv.dev/vulnerability/GHSA-78g4-xqwv-q3g8", + "https://osv.dev/vulnerability/OSV-2025-219" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-114501", + "GHSA-654x-cwwv-5j9c" + ], + "summary": "Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-654x-cwwv-5j9c", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.2.1" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-654x-cwwv-5j9c/GHSA-654x-cwwv-5j9c.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1", + "reachabilityAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", + "untrustedExposure": "Operation-specific preconditions absent from inspected app path; library remains installed. Dependency upgraded rather than risk-accepted.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-654x-cwwv-5j9c", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a", + "https://github.com/python-pillow/Pillow/pull/10172", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-654x-cwwv-5j9c", + "https://nvd.nist.gov/vuln/detail/CVE-2026-114501", + "https://osv.dev/vulnerability/GHSA-654x-cwwv-5j9c" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pillow", + "baselineLockedVersion": "12.3.0", + "currentLockedVersion": "13.0.0", + "observedCurrentWindowsInstalledVersion": "13.0.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-112398", + "GHSA-5x8w-8jj5-q52h" + ], + "summary": "Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution", + "publishedSeverityLabels": [ + "CRITICAL" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-5x8w-8jj5-q52h", + "affected": [ + { + "package": { + "name": "pillow", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pillow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7.0", + "1.7.1", + "1.7.2", + "1.7.3", + "1.7.4", + "1.7.5", + "1.7.6", + "1.7.7", + "1.7.8", + "10.0.0", + "10.0.1", + "10.1.0", + "10.2.0", + "10.3.0", + "10.4.0", + "11.0.0", + "11.1.0", + "11.2.1", + "11.3.0", + "12.0.0", + "12.1.0", + "12.1.1", + "12.2.0", + "12.3.0", + "2.0.0", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.3.2", + "2.4.0", + "2.5.0", + "2.5.1", + "2.5.2", + "2.5.3", + "2.6.0", + "2.6.1", + "2.6.2", + "2.7.0", + "2.8.0", + "2.8.1", + "2.8.2", + "2.9.0", + "3.0.0", + "3.1.0", + "3.1.0.rc1", + "3.1.0rc1", + "3.1.1", + "3.1.2", + "3.2.0", + "3.3.0", + "3.3.1", + "3.3.2", + "3.3.3", + "3.4.0", + "3.4.1", + "3.4.2", + "4.0.0", + "4.1.0", + "4.1.1", + "4.2.0", + "4.2.1", + "4.3.0", + "5.0.0", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.4.0.dev0", + "5.4.1", + "6.0.0", + "6.1.0", + "6.2.0", + "6.2.1", + "6.2.2", + "7.0.0", + "7.1.0", + "7.1.1", + "7.1.2", + "7.2.0", + "8.0.0", + "8.0.1", + "8.1.0", + "8.1.1", + "8.1.2", + "8.2.0", + "8.3.0", + "8.3.1", + "8.3.2", + "8.4.0", + "9.0.0", + "9.0.1", + "9.1.0", + "9.1.1", + "9.2.0", + "9.3.0", + "9.4.0", + "9.5.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 12.3.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5x8w-8jj5-q52h/GHSA-5x8w-8jj5-q52h.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "13.0.0" + ], + "vulnerableFunctionality": "Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution", + "reachabilityAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", + "untrustedExposure": "Untrusted image uploads, plus rasterized PDF OCR images.", + "availableFixDecision": "13.0.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-5x8w-8jj5-q52h", + "https://github.com/python-pillow/Pillow", + "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", + "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", + "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112398", + "https://osv.dev/vulnerability/GHSA-5x8w-8jj5-q52h" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-102994", + "GHSA-5jq2-8x83-x246", + "PYSEC-2026-4153" + ], + "summary": "pypdf: Possible long runtimes/large memory usage when parsing indirect objects", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-5jq2-8x83-x246", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5jq2-8x83-x246/GHSA-5jq2-8x83-x246.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4153", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4153.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.18.0" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes/large memory usage when parsing indirect objects", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-5jq2-8x83-x246", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/82501d2993c6387833c4949d205caeb188f8bb9e", + "https://github.com/py-pdf/pypdf/pull/4055", + "https://github.com/py-pdf/pypdf/releases/tag/6.18.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-5jq2-8x83-x246", + "https://nvd.nist.gov/vuln/detail/CVE-2026-102994", + "https://osv.dev/vulnerability/GHSA-5jq2-8x83-x246", + "https://osv.dev/vulnerability/PYSEC-2026-4153", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-102995", + "GHSA-fp3h-c4fm-7vvf", + "PYSEC-2026-4154" + ], + "summary": "pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-fp3h-c4fm-7vvf", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-fp3h-c4fm-7vvf/GHSA-fp3h-c4fm-7vvf.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4154", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4154.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.18.1" + ], + "vulnerableFunctionality": "pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-fp3h-c4fm-7vvf", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/319d0b823ce2c311a2435e9fd93c13994d32bb51", + "https://github.com/py-pdf/pypdf/pull/4071", + "https://github.com/py-pdf/pypdf/releases/tag/6.18.1", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3h-c4fm-7vvf", + "https://nvd.nist.gov/vuln/detail/CVE-2026-102995", + "https://osv.dev/vulnerability/GHSA-fp3h-c4fm-7vvf", + "https://osv.dev/vulnerability/PYSEC-2026-4154", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-103000", + "GHSA-w23x-9jrw-r45c", + "PYSEC-2026-4160" + ], + "summary": "pypdf: Possible large memory usage when retrieving alphabetical page labels", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-w23x-9jrw-r45c", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.19.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-w23x-9jrw-r45c/GHSA-w23x-9jrw-r45c.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4160", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.19.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4160.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.19.0" + ], + "vulnerableFunctionality": "pypdf: Possible large memory usage when retrieving alphabetical page labels", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-w23x-9jrw-r45c", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/0d8b5a8832cde1ba308b5c27567b879b7b7eed4a", + "https://github.com/py-pdf/pypdf/pull/4096", + "https://github.com/py-pdf/pypdf/releases/tag/6.19.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-w23x-9jrw-r45c", + "https://nvd.nist.gov/vuln/detail/CVE-2026-103000", + "https://osv.dev/vulnerability/GHSA-w23x-9jrw-r45c", + "https://osv.dev/vulnerability/PYSEC-2026-4160", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-102999", + "GHSA-v247-6f48-mgcj", + "PYSEC-2026-4159" + ], + "summary": "pypdf: Possible long runtimes with large amount of embedded files", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-v247-6f48-mgcj", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.19.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v247-6f48-mgcj/GHSA-v247-6f48-mgcj.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4159", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.19.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4159.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.19.0" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes with large amount of embedded files", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-v247-6f48-mgcj", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/6b10556d13609a68f9ed18bb29fdd8bba88eb2c3", + "https://github.com/py-pdf/pypdf/pull/4081", + "https://github.com/py-pdf/pypdf/releases/tag/6.19.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-v247-6f48-mgcj", + "https://nvd.nist.gov/vuln/detail/CVE-2026-102999", + "https://osv.dev/vulnerability/GHSA-v247-6f48-mgcj", + "https://osv.dev/vulnerability/PYSEC-2026-4159", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-102997", + "GHSA-jw7q-gvrg-4vj3", + "PYSEC-2026-4156" + ], + "summary": "pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-jw7q-gvrg-4vj3", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jw7q-gvrg-4vj3/GHSA-jw7q-gvrg-4vj3.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4156", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4156.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.18.1" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-jw7q-gvrg-4vj3", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/d9d38cf99b115deb562d3b68f36c33027bc04f79", + "https://github.com/py-pdf/pypdf/pull/4073", + "https://github.com/py-pdf/pypdf/releases/tag/6.18.1", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-jw7q-gvrg-4vj3", + "https://nvd.nist.gov/vuln/detail/CVE-2026-102997", + "https://osv.dev/vulnerability/GHSA-jw7q-gvrg-4vj3", + "https://osv.dev/vulnerability/PYSEC-2026-4156", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-102996", + "GHSA-g9cg-prrw-2r8q", + "PYSEC-2026-4155" + ], + "summary": "pypdf: Possible large memory usage when parsing font data", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-g9cg-prrw-2r8q", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-g9cg-prrw-2r8q/GHSA-g9cg-prrw-2r8q.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4155", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.18.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4155.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.18.1" + ], + "vulnerableFunctionality": "pypdf: Possible large memory usage when parsing font data", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-g9cg-prrw-2r8q", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/0fb26eb8cdd01c44b3b2c9fe8329751be2f7cfd5", + "https://github.com/py-pdf/pypdf/pull/4072", + "https://github.com/py-pdf/pypdf/releases/tag/6.18.1", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9cg-prrw-2r8q", + "https://nvd.nist.gov/vuln/detail/CVE-2026-102996", + "https://osv.dev/vulnerability/GHSA-g9cg-prrw-2r8q", + "https://osv.dev/vulnerability/PYSEC-2026-4155", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-102993", + "GHSA-qv6h-rv94-w285", + "PYSEC-2026-4158" + ], + "summary": "pypdf: Possible large memory usage when retrieving Roman page labels", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-qv6h-rv94-w285", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.17.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qv6h-rv94-w285/GHSA-qv6h-rv94-w285.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4158", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.17.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4158.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.17.0" + ], + "vulnerableFunctionality": "pypdf: Possible large memory usage when retrieving Roman page labels", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-qv6h-rv94-w285", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163", + "https://github.com/py-pdf/pypdf/pull/4047", + "https://github.com/py-pdf/pypdf/releases/tag/6.17.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285", + "https://nvd.nist.gov/vuln/detail/CVE-2026-102993", + "https://osv.dev/vulnerability/GHSA-qv6h-rv94-w285", + "https://osv.dev/vulnerability/PYSEC-2026-4158", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-102998", + "GHSA-php9-fj8v-98fj", + "PYSEC-2026-4157" + ], + "summary": "pypdf: Possible long runtimes when generating appearance streams", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-php9-fj8v-98fj", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.19.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-php9-fj8v-98fj/GHSA-php9-fj8v-98fj.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4157", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.19.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pypdf/PYSEC-2026-4157.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.19.0" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes when generating appearance streams", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-php9-fj8v-98fj", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/959467a9b95be83e2dc5ae873ece5f371263ede7", + "https://github.com/py-pdf/pypdf/pull/4087", + "https://github.com/py-pdf/pypdf/releases/tag/6.19.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-php9-fj8v-98fj", + "https://nvd.nist.gov/vuln/detail/CVE-2026-102998", + "https://osv.dev/vulnerability/GHSA-php9-fj8v-98fj", + "https://osv.dev/vulnerability/PYSEC-2026-4157", + "https://pypi.org/project/pypdf" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113792", + "GHSA-qfv9-64jg-mh7p" + ], + "summary": "pypdf: Possible infinite loop in PdfWriter.find_outline_item", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-qfv9-64jg-mh7p", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.20.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qfv9-64jg-mh7p/GHSA-qfv9-64jg-mh7p.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.20.1" + ], + "vulnerableFunctionality": "pypdf: Possible infinite loop in PdfWriter.find_outline_item", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-qfv9-64jg-mh7p", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0", + "https://github.com/py-pdf/pypdf/pull/4188", + "https://github.com/py-pdf/pypdf/releases/tag/6.20.1", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-qfv9-64jg-mh7p", + "https://osv.dev/vulnerability/GHSA-qfv9-64jg-mh7p" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113795", + "GHSA-7mh2-4gg2-979f" + ], + "summary": "pypdf: Possible large memory usage for streams with multiple filters", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-7mh2-4gg2-979f", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.20.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7mh2-4gg2-979f/GHSA-7mh2-4gg2-979f.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.20.0" + ], + "vulnerableFunctionality": "pypdf: Possible large memory usage for streams with multiple filters", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-7mh2-4gg2-979f", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185", + "https://github.com/py-pdf/pypdf/pull/4173", + "https://github.com/py-pdf/pypdf/releases/tag/6.20.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f", + "https://osv.dev/vulnerability/GHSA-7mh2-4gg2-979f" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113793", + "GHSA-9mx8-4j7g-633p" + ], + "summary": "pypdf: Possible infinite loop when removing tree items", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-9mx8-4j7g-633p", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.20.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9mx8-4j7g-633p/GHSA-9mx8-4j7g-633p.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.20.1" + ], + "vulnerableFunctionality": "pypdf: Possible infinite loop when removing tree items", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-9mx8-4j7g-633p", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0", + "https://github.com/py-pdf/pypdf/pull/4188", + "https://github.com/py-pdf/pypdf/releases/tag/6.20.1", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mx8-4j7g-633p", + "https://osv.dev/vulnerability/GHSA-9mx8-4j7g-633p" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113794", + "GHSA-39mj-jf6j-2qj3" + ], + "summary": "pypdf: Possible infinite loop when hitting EOF in standard xref table", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-39mj-jf6j-2qj3", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.20.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-39mj-jf6j-2qj3/GHSA-39mj-jf6j-2qj3.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.20.0" + ], + "vulnerableFunctionality": "pypdf: Possible infinite loop when hitting EOF in standard xref table", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-39mj-jf6j-2qj3", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58", + "https://github.com/py-pdf/pypdf/issues/4169", + "https://github.com/py-pdf/pypdf/pull/4170", + "https://github.com/py-pdf/pypdf/releases/tag/6.20.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3", + "https://osv.dev/vulnerability/GHSA-39mj-jf6j-2qj3" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113786", + "GHSA-5hx5-vpf9-5wcv" + ], + "summary": "pypdf: Unvalidated JPEG image data loading", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-5hx5-vpf9-5wcv", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.21.1" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.20.1", + "6.21.0", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-5hx5-vpf9-5wcv/GHSA-5hx5-vpf9-5wcv.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.21.1" + ], + "vulnerableFunctionality": "pypdf: Unvalidated JPEG image data loading", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-5hx5-vpf9-5wcv", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/512d8eb94eb04be1d1c90504e6da2dcef8679e07", + "https://github.com/py-pdf/pypdf/pull/4222", + "https://github.com/py-pdf/pypdf/releases/tag/6.21.1", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv", + "https://nvd.nist.gov/vuln/detail/CVE-2026-113786", + "https://osv.dev/vulnerability/GHSA-5hx5-vpf9-5wcv" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113791", + "GHSA-cgf9-327m-v77c" + ], + "summary": "pypdf: Possible large memory usage when parsing content streams", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-cgf9-327m-v77c", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.21.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.20.1", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cgf9-327m-v77c/GHSA-cgf9-327m-v77c.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.21.0" + ], + "vulnerableFunctionality": "pypdf: Possible large memory usage when parsing content streams", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-cgf9-327m-v77c", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12", + "https://github.com/py-pdf/pypdf/pull/4218", + "https://github.com/py-pdf/pypdf/releases/tag/6.21.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-cgf9-327m-v77c", + "https://nvd.nist.gov/vuln/detail/CVE-2026-113791", + "https://osv.dev/vulnerability/GHSA-cgf9-327m-v77c" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113790", + "GHSA-f54x-cmq8-qg57" + ], + "summary": "pypdf: Possible large memory usage when parsing arrays and dictionaries", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-f54x-cmq8-qg57", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.21.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.20.1", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f54x-cmq8-qg57/GHSA-f54x-cmq8-qg57.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.21.0" + ], + "vulnerableFunctionality": "pypdf: Possible large memory usage when parsing arrays and dictionaries", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-f54x-cmq8-qg57", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12", + "https://github.com/py-pdf/pypdf/pull/4218", + "https://github.com/py-pdf/pypdf/releases/tag/6.21.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-f54x-cmq8-qg57", + "https://nvd.nist.gov/vuln/detail/CVE-2026-113790", + "https://osv.dev/vulnerability/GHSA-f54x-cmq8-qg57" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-113789", + "GHSA-6vvc-x485-93v7" + ], + "summary": "pypdf: Possible long runtimes/large memory usage when retrieving form fields", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-6vvc-x485-93v7", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.21.0" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.20.1", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6vvc-x485-93v7/GHSA-6vvc-x485-93v7.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.21.0" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes/large memory usage when retrieving form fields", + "reachabilityAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", + "untrustedExposure": "Untrusted PDF bytes are accepted; exact high-level advisory operation is not exposed intentionally.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-6vvc-x485-93v7", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/5ef728f0e16d225c853e89f861ba0a67402fe3f2", + "https://github.com/py-pdf/pypdf/pull/4219", + "https://github.com/py-pdf/pypdf/releases/tag/6.21.0", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-6vvc-x485-93v7", + "https://nvd.nist.gov/vuln/detail/CVE-2026-113789", + "https://osv.dev/vulnerability/GHSA-6vvc-x485-93v7" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-115572", + "GHSA-6c7f-9265-g8fw" + ], + "summary": "pypdf: Possible long runtimes for repeated references to the same missing object", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-6c7f-9265-g8fw", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.21.2" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.20.1", + "6.21.0", + "6.21.1", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6c7f-9265-g8fw/GHSA-6c7f-9265-g8fw.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.21.2" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes for repeated references to the same missing object", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-6c7f-9265-g8fw", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b", + "https://github.com/py-pdf/pypdf/pull/4240", + "https://github.com/py-pdf/pypdf/releases/tag/6.21.2", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw", + "https://osv.dev/vulnerability/GHSA-6c7f-9265-g8fw" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-115585", + "GHSA-jr96-gvgh-j3r4" + ], + "summary": "pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-jr96-gvgh-j3r4", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.21.2" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.20.1", + "6.21.0", + "6.21.1", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jr96-gvgh-j3r4/GHSA-jr96-gvgh-j3r4.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.21.2" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-jr96-gvgh-j3r4", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b", + "https://github.com/py-pdf/pypdf/pull/4240", + "https://github.com/py-pdf/pypdf/releases/tag/6.21.2", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4", + "https://osv.dev/vulnerability/GHSA-jr96-gvgh-j3r4" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "pypdf", + "baselineLockedVersion": "6.16.2", + "currentLockedVersion": "6.21.2", + "observedCurrentWindowsInstalledVersion": "6.21.2", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-115580", + "GHSA-gmh7-3g9r-mjh5" + ], + "summary": "pypdf: Possible long runtimes for large xref table header limits", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-gmh7-3g9r-mjh5", + "affected": [ + { + "package": { + "name": "pypdf", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pypdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.21.2" + } + ] + } + ], + "versions": [ + "1.0", + "1.1", + "1.10", + "1.11", + "1.12", + "1.13", + "1.2", + "1.3", + "1.4", + "1.5", + "1.6", + "1.7", + "1.8", + "1.9", + "3.1.0", + "3.10.0", + "3.11.0", + "3.11.1", + "3.12.0", + "3.12.1", + "3.12.2", + "3.13.0", + "3.14.0", + "3.15.0", + "3.15.1", + "3.15.2", + "3.15.3", + "3.15.4", + "3.15.5", + "3.16.0", + "3.16.1", + "3.16.2", + "3.16.3", + "3.16.4", + "3.17.0", + "3.17.1", + "3.17.2", + "3.17.3", + "3.17.4", + "3.2.0", + "3.2.1", + "3.3.0", + "3.4.0", + "3.4.1", + "3.5.0", + "3.5.1", + "3.5.2", + "3.6.0", + "3.7.0", + "3.7.1", + "3.8.0", + "3.8.1", + "3.9.0", + "3.9.1", + "4.0.0", + "4.0.1", + "4.0.2", + "4.1.0", + "4.2.0", + "4.3.0", + "4.3.1", + "5.0.0", + "5.0.1", + "5.1.0", + "5.2.0", + "5.3.0", + "5.3.1", + "5.4.0", + "5.5.0", + "5.6.0", + "5.6.1", + "5.7.0", + "5.8.0", + "5.9.0", + "6.0.0", + "6.1.0", + "6.1.1", + "6.1.2", + "6.1.3", + "6.10.0", + "6.10.1", + "6.10.2", + "6.11.0", + "6.12.0", + "6.12.1", + "6.12.2", + "6.13.0", + "6.13.1", + "6.13.2", + "6.13.3", + "6.14.0", + "6.14.1", + "6.14.2", + "6.15.0", + "6.16.0", + "6.16.1", + "6.16.2", + "6.17.0", + "6.18.0", + "6.18.1", + "6.19.0", + "6.2.0", + "6.20.0", + "6.20.1", + "6.21.0", + "6.21.1", + "6.3.0", + "6.4.0", + "6.4.1", + "6.4.2", + "6.5.0", + "6.6.0", + "6.6.1", + "6.6.2", + "6.7.0", + "6.7.1", + "6.7.2", + "6.7.3", + "6.7.4", + "6.7.5", + "6.8.0", + "6.9.0", + "6.9.1", + "6.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gmh7-3g9r-mjh5/GHSA-gmh7-3g9r-mjh5.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "6.21.2" + ], + "vulnerableFunctionality": "pypdf: Possible long runtimes for large xref table header limits", + "reachabilityAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", + "untrustedExposure": "Untrusted PDF upload parsing and font/content/xref decoding. No destructive payload or unbounded allocation tested.", + "availableFixDecision": "6.21.2 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-gmh7-3g9r-mjh5", + "https://github.com/py-pdf/pypdf", + "https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2", + "https://github.com/py-pdf/pypdf/pull/4239", + "https://github.com/py-pdf/pypdf/releases/tag/6.21.2", + "https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5", + "https://osv.dev/vulnerability/GHSA-gmh7-3g9r-mjh5" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "setuptools", + "baselineLockedVersion": "84.0.0", + "currentLockedVersion": "84.1.0", + "observedCurrentWindowsInstalledVersion": "84.1.0", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "security-constrained transitive dependency", + "identifiers": [ + "GHSA-xmj3-9gf7-h52w" + ], + "summary": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-xmj3-9gf7-h52w", + "affected": [ + { + "package": { + "name": "setuptools", + "ecosystem": "PyPI", + "purl": "pkg:pypi/setuptools" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "38.2.2" + }, + { + "fixed": "84.1.0" + } + ] + } + ], + "versions": [ + "38.2.3", + "38.2.4", + "38.2.5", + "38.3.0", + "38.4.0", + "38.4.1", + "38.5.0", + "38.5.1", + "38.5.2", + "38.6.0", + "38.6.1", + "38.7.0", + "39.0.0", + "39.0.1", + "39.1.0", + "39.2.0", + "40.0.0", + "40.1.0", + "40.1.1", + "40.2.0", + "40.3.0", + "40.4.0", + "40.4.1", + "40.4.2", + "40.4.3", + "40.5.0", + "40.6.0", + "40.6.1", + "40.6.2", + "40.6.3", + "40.7.0", + "40.7.1", + "40.7.2", + "40.7.3", + "40.8.0", + "40.9.0", + "41.0.0", + "41.0.1", + "41.1.0", + "41.2.0", + "41.3.0", + "41.4.0", + "41.5.0", + "41.5.1", + "41.6.0", + "42.0.0", + "42.0.1", + "42.0.2", + "43.0.0", + "44.0.0", + "44.1.0", + "44.1.1", + "45.0.0", + "45.1.0", + "45.2.0", + "45.3.0", + "46.0.0", + "46.1.0", + "46.1.1", + "46.1.2", + "46.1.3", + "46.2.0", + "46.3.0", + "46.3.1", + "46.4.0", + "47.0.0", + "47.1.0", + "47.1.1", + "47.2.0", + "47.3.0", + "47.3.1", + "47.3.2", + "48.0.0", + "49.0.0", + "49.0.1", + "49.1.0", + "49.1.1", + "49.1.2", + "49.1.3", + "49.2.0", + "49.2.1", + "49.3.0", + "49.3.1", + "49.3.2", + "49.4.0", + "49.5.0", + "49.6.0", + "50.0.0", + "50.0.1", + "50.0.2", + "50.0.3", + "50.1.0", + "50.2.0", + "50.3.0", + "50.3.1", + "50.3.2", + "51.0.0", + "51.1.0", + "51.1.0.post20201221", + "51.1.1", + "51.1.2", + "51.2.0", + "51.3.0", + "51.3.1", + "51.3.2", + "51.3.3", + "52.0.0", + "53.0.0", + "53.1.0", + "54.0.0", + "54.1.0", + "54.1.1", + "54.1.2", + "54.1.3", + "54.2.0", + "56.0.0", + "56.1.0", + "56.2.0", + "57.0.0", + "57.1.0", + "57.2.0", + "57.3.0", + "57.4.0", + "57.5.0", + "58.0.0", + "58.0.1", + "58.0.2", + "58.0.3", + "58.0.4", + "58.1.0", + "58.2.0", + "58.3.0", + "58.4.0", + "58.5.0", + "58.5.1", + "58.5.2", + "58.5.3", + "59.0.1", + "59.1.0", + "59.1.1", + "59.2.0", + "59.3.0", + "59.4.0", + "59.5.0", + "59.6.0", + "59.7.0", + "59.8.0", + "60.0.0", + "60.0.1", + "60.0.2", + "60.0.3", + "60.0.4", + "60.0.5", + "60.1.0", + "60.1.1", + "60.10.0", + "60.2.0", + "60.3.0", + "60.3.1", + "60.4.0", + "60.5.0", + "60.6.0", + "60.7.0", + "60.7.1", + "60.8.0", + "60.8.1", + "60.8.2", + "60.9.0", + "60.9.1", + "60.9.2", + "60.9.3", + "61.0.0", + "61.1.0", + "61.1.1", + "61.2.0", + "61.3.0", + "61.3.1", + "62.0.0", + "62.1.0", + "62.2.0", + "62.3.0", + "62.3.1", + "62.3.2", + "62.3.3", + "62.3.4", + "62.4.0", + "62.5.0", + "62.6.0", + "63.0.0", + "63.0.0b1", + "63.1.0", + "63.2.0", + "63.3.0", + "63.4.0", + "63.4.1", + "63.4.2", + "63.4.3", + "64.0.0", + "64.0.1", + "64.0.2", + "64.0.3", + "65.0.0", + "65.0.1", + "65.0.2", + "65.1.0", + "65.1.1", + "65.2.0", + "65.3.0", + "65.4.0", + "65.4.1", + "65.5.0", + "65.5.1", + "65.6.0", + "65.6.1", + "65.6.2", + "65.6.3", + "65.7.0", + "66.0.0", + "66.1.0", + "66.1.1", + "67.0.0", + "67.1.0", + "67.2.0", + "67.3.1", + "67.3.2", + "67.3.3", + "67.4.0", + "67.5.0", + "67.5.1", + "67.6.0", + "67.6.1", + "67.7.0", + "67.7.1", + "67.7.2", + "67.8.0", + "68.0.0", + "68.1.0", + "68.1.2", + "68.2.0", + "68.2.1", + "68.2.2", + "69.0.0", + "69.0.1", + "69.0.2", + "69.0.3", + "69.1.0", + "69.1.1", + "69.2.0", + "69.3.0", + "69.3.1", + "69.4.0", + "69.4.1", + "69.4.2", + "69.5.0", + "69.5.1", + "70.0.0", + "70.1.0", + "70.1.1", + "70.2.0", + "70.3.0", + "71.0.0", + "71.0.1", + "71.0.2", + "71.0.3", + "71.0.4", + "71.1.0", + "72.0.0", + "72.1.0", + "72.2.0", + "73.0.0", + "73.0.1", + "74.0.0", + "74.1.0", + "74.1.1", + "74.1.2", + "74.1.3", + "75.0.0", + "75.1.0", + "75.2.0", + "75.3.0", + "75.3.1", + "75.3.2", + "75.3.3", + "75.3.4", + "75.4.0", + "75.5.0", + "75.6.0", + "75.7.0", + "75.8.0", + "75.8.1", + "75.8.2", + "75.9.0", + "75.9.1", + "76.0.0", + "76.1.0", + "77.0.1", + "77.0.3", + "78.0.1", + "78.0.2", + "78.1.0", + "78.1.1", + "79.0.0", + "79.0.1", + "80.0.0", + "80.0.1", + "80.1.0", + "80.10.1", + "80.10.2", + "80.2.0", + "80.3.0", + "80.3.1", + "80.4.0", + "80.6.0", + "80.7.0", + "80.7.1", + "80.8.0", + "80.9.0", + "81.0.0", + "82.0.0", + "82.0.1", + "83.0.0", + "84.0.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xmj3-9gf7-h52w/GHSA-xmj3-9gf7-h52w.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "84.1.0" + ], + "vulnerableFunctionality": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", + "reachabilityAssessment": "BUILD/INSTALL PATH: no runtime install or legacy namespace-wheel processing call is exposed by Jobjakt. Installation supply chain remains relevant, especially on Windows.", + "untrustedExposure": "Package installation from controlled pins; not an uploaded-document handler.", + "availableFixDecision": "84.1.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-xmj3-9gf7-h52w", + "https://github.com/pypa/setuptools", + "https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af", + "https://github.com/pypa/setuptools/pull/5329", + "https://github.com/pypa/setuptools/releases/tag/v84.1.0", + "https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w", + "https://osv.dev/vulnerability/GHSA-xmj3-9gf7-h52w" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-3001", + "CVE-2025-3001", + "GHSA-qfhq-4f3w-5fph", + "PYSEC-2025-195" + ], + "summary": "PyTorch is vulnerable to memory corruption through its torch.lstm_cell function", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-qfhq-4f3w-5fph", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-qfhq-4f3w-5fph/GHSA-qfhq-4f3w-5fph.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.10.0" + ], + "vulnerableFunctionality": "PyTorch is vulnerable to memory corruption through its torch.lstm_cell function", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-qfhq-4f3w-5fph", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-195.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/999d94b5ede5f4ec111ba7dd144129e2c2725b03", + "https://github.com/pytorch/pytorch/issues/149626", + "https://github.com/pytorch/pytorch/issues/149626#issue-2935860995", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3001", + "https://vuldb.com/?ctiid.302050", + "https://vuldb.com/?id.302050", + "https://vuldb.com/?submit.524212" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-3000", + "CVE-2025-3000", + "GHSA-rrmf-rvhw-rf47", + "PYSEC-2025-194" + ], + "summary": "PyTorch is vulnerable to memory corruption through its torch.jit.script function", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-rrmf-rvhw-rf47", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.13.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.10.0", + "2.11.0", + "2.12.0", + "2.12.1", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-rrmf-rvhw-rf47/GHSA-rrmf-rvhw-rf47.json", + "last_known_affected_version_range": "<= 2.12.1" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.13.0" + ], + "vulnerableFunctionality": "PyTorch is vulnerable to memory corruption through its torch.jit.script function", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-rrmf-rvhw-rf47", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-194.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/b90c94991cdf8b87c8f7439f79518e0ef2c4ca4f", + "https://github.com/pytorch/pytorch/issues/149623", + "https://github.com/pytorch/pytorch/issues/149623#issue-2935703015", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3000", + "https://vuldb.com/?ctiid.302049", + "https://vuldb.com/?id.302049", + "https://vuldb.com/?submit.524197" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-2999", + "CVE-2025-2999", + "GHSA-vgrw-7cvw-pwgx", + "PYSEC-2025-193" + ], + "summary": "PyTorch is vulnerable to memory corruption through its unpack_sequence function", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-vgrw-7cvw-pwgx", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vgrw-7cvw-pwgx/GHSA-vgrw-7cvw-pwgx.json" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.9.1" + ], + "vulnerableFunctionality": "PyTorch is vulnerable to memory corruption through its unpack_sequence function", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-vgrw-7cvw-pwgx", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-193.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd", + "https://github.com/pytorch/pytorch/issues/149622", + "https://github.com/pytorch/pytorch/issues/149622#issue-2935495265", + "https://nvd.nist.gov/vuln/detail/CVE-2025-2999", + "https://vuldb.com/?ctiid.302048", + "https://vuldb.com/?id.302048", + "https://vuldb.com/?submit.524198" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-2953", + "CVE-2025-2953", + "GHSA-3749-ghw9-m3mg", + "PYSEC-2025-191" + ], + "summary": "PyTorch susceptible to local Denial of Service", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-3749-ghw9-m3mg", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1-rc1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-3749-ghw9-m3mg/GHSA-3749-ghw9-m3mg.json" + } + } + ] + }, + { + "recordId": "PYSEC-2025-191", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.6.0+cu124" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-191.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.1-rc1" + ], + "vulnerableFunctionality": "PyTorch susceptible to local Denial of Service", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-3749-ghw9-m3mg", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-191.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models", + "https://github.com/pytorch/pytorch/issues/149274", + "https://github.com/pytorch/pytorch/issues/149274#issue-2923122269", + "https://nvd.nist.gov/vuln/detail/CVE-2025-2953", + "https://vuldb.com/?ctiid.302006", + "https://vuldb.com/?id.302006", + "https://vuldb.com/?submit.521279" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-46148", + "CVE-2025-46148", + "PYSEC-2025-198" + ], + "summary": "In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-198", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-198.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.0" + ], + "vulnerableFunctionality": "In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://gist.github.com/shaoyuyoung/65a587a579dfdff887b9b35bb79b9093", + "https://github.com/pytorch/pytorch/issues/151198", + "https://github.com/pytorch/pytorch/pull/152993" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-46149", + "CVE-2025-46149", + "PYSEC-2025-199" + ], + "summary": "In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-199", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-199.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.0" + ], + "vulnerableFunctionality": "In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://github.com/pytorch/pytorch/issues/147848", + "https://github.com/pytorch/pytorch/pull/147961" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-46150", + "CVE-2025-46150", + "PYSEC-2025-200" + ], + "summary": "In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-200", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-200.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.0" + ], + "vulnerableFunctionality": "In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://github.com/pytorch/pytorch/issues/141538", + "https://github.com/pytorch/pytorch/issues/141538#issuecomment-2537424658", + "https://github.com/pytorch/pytorch/pull/144395" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-46152", + "CVE-2025-46152", + "PYSEC-2025-201" + ], + "summary": "In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the \"other\" argument.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-201", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-201.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.0" + ], + "vulnerableFunctionality": "In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the \"other\" argument.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://github.com/pytorch/pytorch/issues/143555", + "https://github.com/pytorch/pytorch/pull/143635" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-46153", + "CVE-2025-46153", + "PYSEC-2025-202" + ], + "summary": "PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallback_random=True.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-202", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-202.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.0" + ], + "vulnerableFunctionality": "PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallback_random=True.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a", + "https://github.com/pytorch/pytorch/compare/v2.6.0...v2.7.0", + "https://github.com/pytorch/pytorch/issues/142853", + "https://github.com/pytorch/pytorch/pull/143460" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-55551", + "CVE-2025-55551", + "PYSEC-2025-203" + ], + "summary": "An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-203", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-203.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.9.0" + ], + "vulnerableFunctionality": "An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151401" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-55552", + "CVE-2025-55552", + "PYSEC-2025-204" + ], + "summary": "pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-204", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-204.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.9.0" + ], + "vulnerableFunctionality": "pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/147847" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-55553", + "CVE-2025-55553", + "PYSEC-2025-205" + ], + "summary": "A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-205", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-205.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.1" + ], + "vulnerableFunctionality": "A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151432", + "https://github.com/pytorch/pytorch/pull/154645" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-55554", + "CVE-2025-55554", + "PYSEC-2025-206" + ], + "summary": "pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-206", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-206.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.9.0" + ], + "vulnerableFunctionality": "pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151510" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-55557", + "CVE-2025-55557", + "PYSEC-2025-207" + ], + "summary": "A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-207", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-207.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.1" + ], + "vulnerableFunctionality": "A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151738", + "https://github.com/pytorch/pytorch/pull/151931" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-55558", + "CVE-2025-55558", + "PYSEC-2025-208" + ], + "summary": "A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-208", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-208.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.1" + ], + "vulnerableFunctionality": "A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151523", + "https://github.com/pytorch/pytorch/pull/151887" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-55560", + "CVE-2025-55560", + "PYSEC-2025-209" + ], + "summary": "An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-209", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-209.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.7.1" + ], + "vulnerableFunctionality": "An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND for the named low-level tensor/compiler operation. Application performs eager selected DistilBART inference; it does not expose Python execution, torch.compile/jit/training/custom model APIs. Actual selected-model internals remain unqualified.", + "untrustedExposure": "Typically specially constructed local tensor shapes/operations or compiled graph; user text tokenization is bounded, but no exhaustive model call graph proof.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151522", + "https://github.com/pytorch/pytorch/pull/151897" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2026-4538", + "CVE-2026-4538", + "PYSEC-2026-139" + ], + "summary": "A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project w", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2026-139", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.10.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2026-139.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project w", + "reachabilityAssessment": "MODEL/RESOURCE PATH REQUIRES QUALIFICATION: model loading and generate are present. No direct torch.load or pt2 loader is in application source, but Transformers internals and actual checkpoint format/revision were not executed or verified.", + "untrustedExposure": "Remote/cached fixed-repository model artifacts; uploaded CVs do not select arbitrary checkpoint paths. No model is cached at the standard local user snapshot path inspected.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/pytorch/pytorch/", + "https://github.com/pytorch/pytorch/pull/176791", + "https://vuldb.com/?ctiid.352326", + "https://vuldb.com/?id.352326", + "https://vuldb.com/?submit.774681" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2025-3730", + "CVE-2025-3730", + "GHSA-887c-mr87-cxwp", + "PYSEC-2026-1970" + ], + "summary": "PyTorch Improper Resource Shutdown or Release vulnerability", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-887c-mr87-cxwp", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1" + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.7.1", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-887c-mr87-cxwp/GHSA-887c-mr87-cxwp.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1970", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2026-1970.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.8.0" + ], + "vulnerableFunctionality": "PyTorch Improper Resource Shutdown or Release vulnerability", + "reachabilityAssessment": "MODEL/RESOURCE PATH REQUIRES QUALIFICATION: model loading and generate are present. No direct torch.load or pt2 loader is in application source, but Transformers internals and actual checkpoint format/revision were not executed or verified.", + "untrustedExposure": "Remote/cached fixed-repository model artifacts; uploaded CVs do not select arbitrary checkpoint paths. No model is cached at the standard local user snapshot path inspected.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-887c-mr87-cxwp", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af", + "https://github.com/pytorch/pytorch/issues/150835", + "https://github.com/pytorch/pytorch/pull/150981", + "https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3730", + "https://pypi.org/project/torch", + "https://vuldb.com/?ctiid.305076", + "https://vuldb.com/?id.305076", + "https://vuldb.com/?submit.553645" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "torch", + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersion": "2.6.0+cpu", + "observedCurrentWindowsInstalledVersion": "2.6.0", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "BIT-pytorch-2026-24747", + "CVE-2026-24747", + "GHSA-63cw-57p8-fm3p", + "PYSEC-2026-1856", + "PYSEC-2026-2286" + ], + "summary": "PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentiall", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2026-2286", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2026-2286.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.10.0" + ], + "vulnerableFunctionality": "PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentiall", + "reachabilityAssessment": "MODEL/RESOURCE PATH REQUIRES QUALIFICATION: model loading and generate are present. No direct torch.load or pt2 loader is in application source, but Transformers internals and actual checkpoint format/revision were not executed or verified.", + "untrustedExposure": "Remote/cached fixed-repository model artifacts; uploaded CVs do not select arbitrary checkpoint paths. No model is cached at the standard local user snapshot path inspected.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://access.redhat.com/errata/RHSA-2026:24977", + "https://access.redhat.com/security/cve/CVE-2026-24747", + "https://bugzilla.redhat.com/show_bug.cgi?id=2433612", + "https://github.com/advisories/GHSA-63cw-57p8-fm3p", + "https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139", + "https://github.com/pytorch/pytorch/issues/163105", + "https://github.com/pytorch/pytorch/releases/tag/v2.10.0", + "https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p", + "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json" + ], + "beforeProviderRecords": 1, + "afterProviderRecords": 1, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14929", + "PYSEC-2025-217" + ], + "summary": "Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vuln", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-217", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.0-rc0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-217.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vuln", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-217", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1144/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-2099", + "GHSA-qq3j-4f4f-9583", + "PYSEC-2025-40" + ], + "summary": "Hugging Face Transformers Regular Expression Denial of Service", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-qq3j-4f4f-9583", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-qq3j-4f4f-9583/GHSA-qq3j-4f4f-9583.json" + } + } + ] + }, + { + "recordId": "PYSEC-2025-40", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "GIT", + "repo": "https://github.com/huggingface/transformers", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8cb522b4190bd556ce51be04942720650b1a3e57" + } + ] + }, + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.49.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "v4.49.0-AyaVision", + "v4.49.0-SigLIP-2", + "v4.49.0-SmolVLM-2", + "v4.33.1", + "v4.16.0", + "v4.15.0", + "v4.14.0", + "v4.13.0", + "v4.12.0", + "v4.11.0", + "v4.10.0", + "v4.9.0", + "v4.8.0", + "v4.7.0", + "v4.6.0", + "v4.5.0", + "v4.4.0", + "v4.3.0.rc1", + "4.3.0.rc1", + "v4.2.0", + "v4.1.1", + "v4.1.0", + "v3.5.0", + "v3.4.0", + "v3.3.1", + "v3.3.0", + "v3.2.0", + "v3.1.0", + "v3.0.2", + "v3.0.1", + "v3.0.0", + "v2.11.0", + "v2.10.0", + "v2.9.1", + "v2.9.0", + "v2.8.0", + "v2.7.0", + "v2.6.0", + "v2.5.1", + "v2.5.0", + "v2.4.1", + "v2.4.0", + "v2.3.0", + "v2.2.2", + "v2.2.1", + "v2.2.0", + "v2.1.1", + "v2.1.0", + "v2.0.0", + "1.2.0", + "1.1.0", + "1.0", + "v0.6.2", + "v0.6.1", + "v0.6.0", + "v0.5.1", + "v0.5.0", + "0.5.0", + "v0.4.0", + "v0.3.0", + "v0.2.0", + "v0.1.2", + "0.1.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-40.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.49.0", + "4.50.0", + "8cb522b4190bd556ce51be04942720650b1a3e57" + ], + "vulnerableFunctionality": "Hugging Face Transformers Regular Expression Denial of Service", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-qq3j-4f4f-9583", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57", + "https://github.com/huggingface/transformers/pull/36648", + "https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml", + "https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4", + "https://nvd.nist.gov/vuln/detail/CVE-2025-2099", + "https://osv.dev/vulnerability/GHSA-qq3j-4f4f-9583", + "https://osv.dev/vulnerability/PYSEC-2025-40" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14926", + "PYSEC-2025-214" + ], + "summary": "Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target ", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-214", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-214.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target ", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-214", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14930", + "PYSEC-2025-218" + ], + "summary": "Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the ta", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-218", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-218.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the ta", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-218", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14920", + "PYSEC-2025-211" + ], + "summary": "Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in ", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-211", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.54.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-211.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in ", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-211", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1150/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14921", + "PYSEC-2025-212" + ], + "summary": "Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerabilit", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-212", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.54.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-212.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerabilit", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-212", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1149/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14924", + "PYSEC-2025-213" + ], + "summary": "Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-213", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.55.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-213.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-213", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1141/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14927", + "PYSEC-2025-215" + ], + "summary": "Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targe", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-215", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-215.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targe", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-215", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-14928", + "PYSEC-2025-216" + ], + "summary": "Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targ", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-216", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-216.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [], + "vulnerableFunctionality": "Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targ", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://osv.dev/vulnerability/PYSEC-2025-216", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/" + ], + "beforeProviderRecords": 2, + "afterProviderRecords": 2, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-3933", + "GHSA-37mw-44qp-f5jm", + "PYSEC-2026-1977" + ], + "summary": "Transformers is vulnerable to ReDoS attack through its DonutProcessor class", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-37mw-44qp-f5jm", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.51.3", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-37mw-44qp-f5jm/GHSA-37mw-44qp-f5jm.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1977", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1977.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.52.1" + ], + "vulnerableFunctionality": "Transformers is vulnerable to ReDoS attack through its DonutProcessor class", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-37mw-44qp-f5jm", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93", + "https://github.com/huggingface/transformers/pull/37788", + "https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3933", + "https://osv.dev/vulnerability/GHSA-37mw-44qp-f5jm", + "https://osv.dev/vulnerability/PYSEC-2026-1977", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-6638", + "GHSA-59p9-h35m-wg4g", + "PYSEC-2026-1981" + ], + "summary": "Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-59p9-h35m-wg4g", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-59p9-h35m-wg4g/GHSA-59p9-h35m-wg4g.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1981", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1981.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.53.0" + ], + "vulnerableFunctionality": "Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-59p9-h35m-wg4g", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be", + "https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099", + "https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36", + "https://nvd.nist.gov/vuln/detail/CVE-2025-6638", + "https://osv.dev/vulnerability/GHSA-59p9-h35m-wg4g", + "https://osv.dev/vulnerability/PYSEC-2026-1981", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-3264", + "GHSA-jjph-296x-mrcr", + "PYSEC-2026-1985" + ], + "summary": "Transformers vulnerable to ReDoS attack through its get_imports() function", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-jjph-296x-mrcr", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-jjph-296x-mrcr/GHSA-jjph-296x-mrcr.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1985", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1985.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.51.0" + ], + "vulnerableFunctionality": "Transformers vulnerable to ReDoS attack through its get_imports() function", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-jjph-296x-mrcr", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76", + "https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca", + "https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3264", + "https://osv.dev/vulnerability/GHSA-jjph-296x-mrcr", + "https://osv.dev/vulnerability/PYSEC-2026-1985", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-1194", + "GHSA-fpwr-67px-3qhx", + "PYSEC-2026-1984" + ], + "summary": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-fpwr-67px-3qhx", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-fpwr-67px-3qhx/GHSA-fpwr-67px-3qhx.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1984", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1984.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.50.0" + ], + "vulnerableFunctionality": "Transformers Regular Expression Denial of Service (ReDoS) vulnerability", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-fpwr-67px-3qhx", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815", + "https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2", + "https://nvd.nist.gov/vuln/detail/CVE-2025-1194", + "https://osv.dev/vulnerability/GHSA-fpwr-67px-3qhx", + "https://osv.dev/vulnerability/PYSEC-2026-1984", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-3777", + "GHSA-phhr-52qp-3mj4", + "PYSEC-2026-1986" + ], + "summary": "Transformers's Improper Input Validation vulnerability can be exploited through username injection", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-phhr-52qp-3mj4", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-phhr-52qp-3mj4/GHSA-phhr-52qp-3mj4.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1986", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1986.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.52.1" + ], + "vulnerableFunctionality": "Transformers's Improper Input Validation vulnerability can be exploited through username injection", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-phhr-52qp-3mj4", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/blame/a7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4/src/transformers/image_utils.py", + "https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082", + "https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3777", + "https://osv.dev/vulnerability/GHSA-phhr-52qp-3mj4", + "https://osv.dev/vulnerability/PYSEC-2026-1986", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-6051", + "GHSA-rcv9-qm8p-9p6j", + "PYSEC-2026-1988" + ], + "summary": "Hugging Face Transformers library has Regular Expression Denial of Service", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-rcv9-qm8p-9p6j", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-rcv9-qm8p-9p6j/GHSA-rcv9-qm8p-9p6j.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1988", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1988.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.53.0" + ], + "vulnerableFunctionality": "Hugging Face Transformers library has Regular Expression Denial of Service", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-rcv9-qm8p-9p6j", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216", + "https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0", + "https://github.com/huggingface/transformers/pull/38844", + "https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d", + "https://nvd.nist.gov/vuln/detail/CVE-2025-6051", + "https://osv.dev/vulnerability/GHSA-rcv9-qm8p-9p6j", + "https://osv.dev/vulnerability/PYSEC-2026-1988", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-6921", + "GHSA-4w7r-h757-3r74", + "PYSEC-2026-1980" + ], + "summary": "Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-4w7r-h757-3r74", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-4w7r-h757-3r74/GHSA-4w7r-h757-3r74.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1980", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1980.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.53.0" + ], + "vulnerableFunctionality": "Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-4w7r-h757-3r74", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be", + "https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099", + "https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f", + "https://nvd.nist.gov/vuln/detail/CVE-2025-6921", + "https://osv.dev/vulnerability/GHSA-4w7r-h757-3r74", + "https://osv.dev/vulnerability/PYSEC-2026-1980", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-3263", + "GHSA-q2wp-rjmx-x6x9", + "PYSEC-2026-1987" + ], + "summary": "Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-q2wp-rjmx-x6x9", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-q2wp-rjmx-x6x9/GHSA-q2wp-rjmx-x6x9.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1987", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1987.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.51.0" + ], + "vulnerableFunctionality": "Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-q2wp-rjmx-x6x9", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76", + "https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca", + "https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3263", + "https://osv.dev/vulnerability/GHSA-q2wp-rjmx-x6x9", + "https://osv.dev/vulnerability/PYSEC-2026-1987", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2025-5197", + "GHSA-9356-575x-2w9m", + "PYSEC-2026-1983" + ], + "summary": "Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-9356-575x-2w9m", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-9356-575x-2w9m/GHSA-9356-575x-2w9m.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1983", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1983.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "4.53.0" + ], + "vulnerableFunctionality": "Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-9356-575x-2w9m", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/701caef704e356dc2f9331cc3fd5df0eccb4720a", + "https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b", + "https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf", + "https://nvd.nist.gov/vuln/detail/CVE-2025-5197", + "https://osv.dev/vulnerability/GHSA-9356-575x-2w9m", + "https://osv.dev/vulnerability/PYSEC-2026-1983", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-1839", + "GHSA-69w3-r845-3855", + "PYSEC-2026-2288" + ], + "summary": "HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-69w3-r845-3855", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.0rc3" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69w3-r845-3855/GHSA-69w3-r845-3855.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-2288", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-2288.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "5.0.0", + "5.0.0rc3" + ], + "vulnerableFunctionality": "HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-69w3-r845-3855", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396", + "https://github.com/huggingface/transformers/releases/tag/v5.0.0rc3", + "https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485", + "https://nvd.nist.gov/vuln/detail/CVE-2026-1839", + "https://osv.dev/vulnerability/GHSA-69w3-r845-3855", + "https://osv.dev/vulnerability/PYSEC-2026-2288" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-4372", + "GHSA-29pf-2h5f-8g72", + "PYSEC-2026-2289" + ], + "summary": "HuggingFace transformers vulnerable to remote code execution", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-29pf-2h5f-8g72", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-29pf-2h5f-8g72/GHSA-29pf-2h5f-8g72.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-2289", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-2289.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "5.3.0" + ], + "vulnerableFunctionality": "HuggingFace transformers vulnerable to remote code execution", + "reachabilityAssessment": "MODEL-LOADING PATH REQUIRES QUALIFICATION: fixed repository from_pretrained calls are present, with no explicit immutable revision or artifact integrity record. Shared configuration/dynamic module helpers and serialized model inputs require dependency/runtime-specific tracing; actual exploitability is NOT established.", + "untrustedExposure": "Remote/cached model artifacts and tokenizer input. No upload-to-model path, model download or exploit testing performed.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-29pf-2h5f-8g72", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f", + "https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884", + "https://nvd.nist.gov/vuln/detail/CVE-2026-4372", + "https://osv.dev/vulnerability/GHSA-29pf-2h5f-8g72", + "https://osv.dev/vulnerability/PYSEC-2026-2289" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-5241", + "GHSA-fgcw-684q-jj6r", + "PYSEC-2026-2290" + ], + "summary": "huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-fgcw-684q-jj6r", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.5.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fgcw-684q-jj6r/GHSA-fgcw-684q-jj6r.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-2290", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.2.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-2290.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "5.5.0" + ], + "vulnerableFunctionality": "huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://access.redhat.com/errata/RHSA-2026:34456", + "https://access.redhat.com/errata/RHSA-2026:37275", + "https://access.redhat.com/errata/RHSA-2026:42644", + "https://access.redhat.com/security/cve/CVE-2026-5241", + "https://bugzilla.redhat.com/show_bug.cgi?id=2484384", + "https://github.com/advisories/GHSA-fgcw-684q-jj6r", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e", + "https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2026-2290.yaml", + "https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619", + "https://nvd.nist.gov/vuln/detail/CVE-2026-5241", + "https://osv.dev/vulnerability/GHSA-fgcw-684q-jj6r", + "https://osv.dev/vulnerability/PYSEC-2026-2290", + "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "transformers", + "baselineLockedVersion": "4.48.3", + "currentLockedVersion": "4.48.3", + "observedCurrentWindowsInstalledVersion": "4.48.3", + "baselineDependencyKind": "direct application requirement", + "currentRequirementRole": "direct application requirement", + "identifiers": [ + "CVE-2026-9856", + "GHSA-xrqw-3rrv-vx5w", + "PYSEC-2026-3929" + ], + "summary": "Transformers save_pretrained path traversal allows arbitrary file writes through chat template names", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-xrqw-3rrv-vx5w", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.10.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.5.0", + "5.5.1", + "5.5.2", + "5.5.3", + "5.5.4", + "5.6.0", + "5.6.1", + "5.6.2", + "5.7.0", + "5.8.0", + "5.8.1", + "5.9.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xrqw-3rrv-vx5w/GHSA-xrqw-3rrv-vx5w.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-3929", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.10.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.5.0", + "5.5.1", + "5.5.2", + "5.5.3", + "5.5.4", + "5.6.0", + "5.6.1", + "5.6.2", + "5.7.0", + "5.8.0", + "5.8.1", + "5.9.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-3929.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "5.10.0" + ], + "vulnerableFunctionality": "Transformers save_pretrained path traversal allows arbitrary file writes through chat template names", + "reachabilityAssessment": "NO MATCHING APPLICATION CALL FOUND: selected loader is fixed DistilBART AutoTokenizer/AutoModelForSeq2SeqLM and generate; application exposes no Trainer, conversion, alternative model family, save_pretrained or arbitrary model-repository API. Third-party internals not exhaustively proven.", + "untrustedExposure": "Usually malicious model/conversion assets, repository code, training checkpoint or model-family-specific text. Upload parsing does not load arbitrary models.", + "availableFixDecision": "Published fixed events retained; no compatible fully qualified selected-model/cache transition established.", + "compatibilityImplications": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-xrqw-3rrv-vx5w", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/eaaaf8494dd5386634ae37d1d122212fdc315be5", + "https://github.com/huggingface/transformers/pull/46191", + "https://huntr.com/bounties/362824d5-fe18-40e8-a6cf-62277f97a170", + "https://nvd.nist.gov/vuln/detail/CVE-2026-9856", + "https://osv.dev/vulnerability/GHSA-xrqw-3rrv-vx5w", + "https://osv.dev/vulnerability/PYSEC-2026-3929", + "https://pypi.org/project/transformers" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 4, + "status": "BLOCKED_MODEL_RUNTIME_QUALIFICATION", + "requiredAction": "Security/AI owner: trace selected-model runtime and qualify compatible patched graph; do not accept serious unresolved risk on owner behalf." + }, + { + "package": "urllib3", + "baselineLockedVersion": "2.7.0", + "currentLockedVersion": "2.8.0", + "observedCurrentWindowsInstalledVersion": "2.8.0", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "security-constrained transitive dependency", + "identifiers": [ + "CVE-2026-97689", + "GHSA-vxq7-64xx-v4gw", + "PYSEC-2026-4177" + ], + "summary": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-vxq7-64xx-v4gw", + "affected": [ + { + "package": { + "name": "urllib3", + "ecosystem": "PyPI", + "purl": "pkg:pypi/urllib3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.10.3" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.10.3", + "1.10.4", + "1.11", + "1.12", + "1.13", + "1.13.1", + "1.14", + "1.15", + "1.15.1", + "1.16", + "1.17", + "1.18", + "1.18.1", + "1.19", + "1.19.1", + "1.20", + "1.21", + "1.21.1", + "1.22", + "1.23", + "1.24", + "1.24.1", + "1.24.2", + "1.24.3", + "1.25", + "1.25.1", + "1.25.10", + "1.25.11", + "1.25.2", + "1.25.3", + "1.25.4", + "1.25.5", + "1.25.6", + "1.25.7", + "1.25.8", + "1.25.9", + "1.26.0", + "1.26.1", + "1.26.10", + "1.26.11", + "1.26.12", + "1.26.13", + "1.26.14", + "1.26.15", + "1.26.16", + "1.26.17", + "1.26.18", + "1.26.19", + "1.26.2", + "1.26.20", + "1.26.3", + "1.26.4", + "1.26.5", + "1.26.6", + "1.26.7", + "1.26.8", + "1.26.9", + "2.0.0", + "2.0.0a1", + "2.0.0a2", + "2.0.0a3", + "2.0.0a4", + "2.0.1", + "2.0.2", + "2.0.3", + "2.0.4", + "2.0.5", + "2.0.6", + "2.0.7", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.2.3", + "2.3.0", + "2.4.0", + "2.5.0", + "2.6.0", + "2.6.1", + "2.6.2", + "2.6.3", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-vxq7-64xx-v4gw/GHSA-vxq7-64xx-v4gw.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4177", + "affected": [ + { + "package": { + "name": "urllib3", + "ecosystem": "PyPI", + "purl": "pkg:pypi/urllib3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.10.3" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.10.3", + "1.10.4", + "1.11", + "1.12", + "1.13", + "1.13.1", + "1.14", + "1.15", + "1.15.1", + "1.16", + "1.17", + "1.18", + "1.18.1", + "1.19", + "1.19.1", + "1.20", + "1.21", + "1.21.1", + "1.22", + "1.23", + "1.24", + "1.24.1", + "1.24.2", + "1.24.3", + "1.25", + "1.25.1", + "1.25.10", + "1.25.11", + "1.25.2", + "1.25.3", + "1.25.4", + "1.25.5", + "1.25.6", + "1.25.7", + "1.25.8", + "1.25.9", + "1.26.0", + "1.26.1", + "1.26.10", + "1.26.11", + "1.26.12", + "1.26.13", + "1.26.14", + "1.26.15", + "1.26.16", + "1.26.17", + "1.26.18", + "1.26.19", + "1.26.2", + "1.26.20", + "1.26.3", + "1.26.4", + "1.26.5", + "1.26.6", + "1.26.7", + "1.26.8", + "1.26.9", + "2.0.0", + "2.0.0a1", + "2.0.0a2", + "2.0.0a3", + "2.0.0a4", + "2.0.1", + "2.0.2", + "2.0.3", + "2.0.4", + "2.0.5", + "2.0.6", + "2.0.7", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.2.3", + "2.3.0", + "2.4.0", + "2.5.0", + "2.6.0", + "2.6.1", + "2.6.2", + "2.6.3", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/urllib3/PYSEC-2026-4177.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.8.0" + ], + "vulnerableFunctionality": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory", + "reachabilityAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.", + "untrustedExposure": "Outbound remote responses and optional configured proxy; upload parser does not use urllib3 for local files.", + "availableFixDecision": "2.8.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-vxq7-64xx-v4gw", + "https://github.com/urllib3/urllib3", + "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", + "https://github.com/urllib3/urllib3/releases/tag/2.8.0", + "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", + "https://nvd.nist.gov/vuln/detail/CVE-2026-97689", + "https://osv.dev/vulnerability/GHSA-vxq7-64xx-v4gw", + "https://osv.dev/vulnerability/PYSEC-2026-4177", + "https://pypi.org/project/urllib3" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "urllib3", + "baselineLockedVersion": "2.7.0", + "currentLockedVersion": "2.8.0", + "observedCurrentWindowsInstalledVersion": "2.8.0", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "security-constrained transitive dependency", + "identifiers": [ + "CVE-2026-97688", + "GHSA-gh4c-6fx4-qh6g", + "PYSEC-2026-4176" + ], + "summary": "urllib3: Chunked Deflate streaming can enter an infinite loop", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-gh4c-6fx4-qh6g", + "affected": [ + { + "package": { + "name": "urllib3", + "ecosystem": "PyPI", + "purl": "pkg:pypi/urllib3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.2" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "2.6.2", + "2.6.3", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gh4c-6fx4-qh6g/GHSA-gh4c-6fx4-qh6g.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4176", + "affected": [ + { + "package": { + "name": "urllib3", + "ecosystem": "PyPI", + "purl": "pkg:pypi/urllib3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.2" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "2.6.2", + "2.6.3", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/urllib3/PYSEC-2026-4176.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.8.0" + ], + "vulnerableFunctionality": "urllib3: Chunked Deflate streaming can enter an infinite loop", + "reachabilityAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.", + "untrustedExposure": "Outbound remote responses and optional configured proxy; upload parser does not use urllib3 for local files.", + "availableFixDecision": "2.8.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-gh4c-6fx4-qh6g", + "https://github.com/urllib3/urllib3", + "https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f", + "https://github.com/urllib3/urllib3/releases/tag/2.8.0", + "https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g", + "https://nvd.nist.gov/vuln/detail/CVE-2026-97688", + "https://osv.dev/vulnerability/GHSA-gh4c-6fx4-qh6g", + "https://osv.dev/vulnerability/PYSEC-2026-4176", + "https://pypi.org/project/urllib3" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + }, + { + "package": "urllib3", + "baselineLockedVersion": "2.7.0", + "currentLockedVersion": "2.8.0", + "observedCurrentWindowsInstalledVersion": "2.8.0", + "baselineDependencyKind": "transitive dependency", + "currentRequirementRole": "security-constrained transitive dependency", + "identifiers": [ + "CVE-2026-97687", + "GHSA-8988-9cw3-xx77", + "PYSEC-2026-4175" + ], + "summary": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "publishedAffectedRangesAndVersions": [ + { + "recordId": "GHSA-8988-9cw3-xx77", + "affected": [ + { + "package": { + "name": "urllib3", + "ecosystem": "PyPI", + "purl": "pkg:pypi/urllib3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.26.0" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.26.0", + "1.26.1", + "1.26.10", + "1.26.11", + "1.26.12", + "1.26.13", + "1.26.14", + "1.26.15", + "1.26.16", + "1.26.17", + "1.26.18", + "1.26.19", + "1.26.2", + "1.26.20", + "1.26.3", + "1.26.4", + "1.26.5", + "1.26.6", + "1.26.7", + "1.26.8", + "1.26.9", + "2.0.0", + "2.0.0a1", + "2.0.0a2", + "2.0.0a3", + "2.0.0a4", + "2.0.1", + "2.0.2", + "2.0.3", + "2.0.4", + "2.0.5", + "2.0.6", + "2.0.7", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.2.3", + "2.3.0", + "2.4.0", + "2.5.0", + "2.6.0", + "2.6.1", + "2.6.2", + "2.6.3", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8988-9cw3-xx77/GHSA-8988-9cw3-xx77.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-4175", + "affected": [ + { + "package": { + "name": "urllib3", + "ecosystem": "PyPI", + "purl": "pkg:pypi/urllib3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.26.0" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.26.0", + "1.26.1", + "1.26.10", + "1.26.11", + "1.26.12", + "1.26.13", + "1.26.14", + "1.26.15", + "1.26.16", + "1.26.17", + "1.26.18", + "1.26.19", + "1.26.2", + "1.26.20", + "1.26.3", + "1.26.4", + "1.26.5", + "1.26.6", + "1.26.7", + "1.26.8", + "1.26.9", + "2.0.0", + "2.0.0a1", + "2.0.0a2", + "2.0.0a3", + "2.0.0a4", + "2.0.1", + "2.0.2", + "2.0.3", + "2.0.4", + "2.0.5", + "2.0.6", + "2.0.7", + "2.1.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.2.3", + "2.3.0", + "2.4.0", + "2.5.0", + "2.6.0", + "2.6.1", + "2.6.2", + "2.6.3", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/urllib3/PYSEC-2026-4175.yaml" + } + } + ] + } + ], + "publishedFixedVersionEvents": [ + "2.8.0" + ], + "vulnerableFunctionality": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden", + "reachabilityAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.", + "untrustedExposure": "Outbound remote responses and optional configured proxy; upload parser does not use urllib3 for local files.", + "availableFixDecision": "2.8.0 selected and locally tested", + "compatibilityImplications": "Pillow13 removed APIs checked against actual Image.open/convert/OCR use and Python3.12; pypdf6.21.2 extraction contract tested; TLS/build pins preserve API. Full model loading not exercised.", + "evidenceSources": [ + "https://github.com/advisories/GHSA-8988-9cw3-xx77", + "https://github.com/urllib3/urllib3", + "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465", + "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3", + "https://github.com/urllib3/urllib3/pull/5093", + "https://github.com/urllib3/urllib3/releases/tag/2.8.0", + "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", + "https://nvd.nist.gov/vuln/detail/CVE-2026-97687", + "https://osv.dev/vulnerability/GHSA-8988-9cw3-xx77", + "https://osv.dev/vulnerability/PYSEC-2026-4175", + "https://pypi.org/project/urllib3" + ], + "beforeProviderRecords": 4, + "afterProviderRecords": 0, + "status": "REMEDIATED_VERSION_LOCAL_REGRESSION_PASS", + "requiredAction": "Retain exact pins/hash lock and regression evidence; rebuild separately approved images before release. No deployed remediation claimed." + } + ] +} diff --git a/docs/redesign/phase-9/p9-remed-02/security/evidence-manifest.json b/docs/redesign/phase-9/p9-remed-02/security/evidence-manifest.json new file mode 100644 index 0000000..0911df6 --- /dev/null +++ b/docs/redesign/phase-9/p9-remed-02/security/evidence-manifest.json @@ -0,0 +1,2115 @@ +{ + "generatedUtc": "2026-10-24T17:09:44.302477+00:00", + "files": [ + { + "path": ".artifacts/p9-remed-02/security/benign.txt", + "sha256": "0b36e56510902f2c87b8ff96a013216bede136f0d7961829d00738f5e4f78b03", + "bytes": 138 + }, + { + "path": ".artifacts/p9-remed-02/security/compile.json", + "sha256": "234b41b6f44e63c27f4874c49b6300cdce42cfff2df15b9d906995fd9e4ba515", + "bytes": 481 + }, + { + "path": ".artifacts/p9-remed-02/security/compile.log", + "sha256": "740f2fd0fde48eb993e02cc6d6e306f29ef049c5b35ce857e1a8dfe7fbd656f5", + "bytes": 119421 + }, + { + "path": ".artifacts/p9-remed-02/security/install.json", + "sha256": "db92bc2aa98d2f4f2bd0a82a54e98f54743d1383071c7957c51c9441d31d5e09", + "bytes": 404 + }, + { + "path": ".artifacts/p9-remed-02/security/install.log", + "sha256": "91e8c358ab91d38e681c8e6548b1b05d4a7a8f2d3a00fc1ab4fcd52c3ddb6d77", + "bytes": 746 + }, + { + "path": ".artifacts/p9-remed-02/security/installed.json", + "sha256": "77941c9b2f0f44b82fd547376c8b365f0a0c724485ced586c5366864438e8657", + "bytes": 2111 + }, + { + "path": ".artifacts/p9-remed-02/security/inventory.py", + "sha256": "24239d2b8e2ac54ab0c0dd8b7ee2389ad12595a9cecdfa8de50ace38c9918cb1", + "bytes": 13310 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-parser-build.json", + "sha256": "21e7a0af32721b54d1bad3f1dc77ccdb96e6c59aa757a074d39dab80e2eb6233", + "bytes": 326 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-parser-build.log", + "sha256": "2334e69bddd26f222aaa30e1d2058caa770e0952e0c37f5bdaec2c7d01ff80fb", + "bytes": 7404 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-parser-proof.py", + "sha256": "c082c540951493cad2a92cb2c245d7cfd188cd75b43ef908a9cf20ad27f9e479", + "bytes": 1313 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-parser-requirements.txt", + "sha256": "8680a4bcd6f5d63cf2877d5bc99a9c8334be1c3c3e3ba85993ec88c775357d72", + "bytes": 201 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-parser-wheels.log", + "sha256": "9739ef12b023af2fab484b0dc24183c536478eedf8c6a839381d2066da0be8ce", + "bytes": 4101 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-parser.json", + "sha256": "311ddccad8a801025e0fd985f72d816595c6f96560974ab1d4e7fc661ba3f597", + "bytes": 3213 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-parser.log", + "sha256": "3e3b7e3ea77da8c44827b5d3e383b147250bf834cd9ffd0789b946d6fc2b16ea", + "bytes": 1813 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-wheels.json", + "sha256": "3521437ebaeff2f43275134cfc721382cd66181e36bc740233308b193f95abad", + "bytes": 921 + }, + { + "path": ".artifacts/p9-remed-02/security/linux-wheels.log", + "sha256": "b979ecc090b24c602b98863441d8e9dad0b1ebf858ffa8b08dbefacb989fffbe", + "bytes": 1724 + }, + { + "path": ".artifacts/p9-remed-02/security/parser-red.json", + "sha256": "c97ce24adf22a7019d9e95ff4450ed19166ee3a12d50b9ec5dfef175a46bb78a", + "bytes": 237 + }, + { + "path": ".artifacts/p9-remed-02/security/parser-red.log", + "sha256": "414e669f431c500345b9a316e5ff50532eb6f3d5652274d9f7cfc2fdcd0bef2c", + "bytes": 1964 + }, + { + "path": ".artifacts/p9-remed-02/security/sidecar.json", + "sha256": "13ddce712745adb3bf0c7f497513d1c4a3660458a6a6cdc2faef2407ef8dd201", + "bytes": 441 + }, + { + "path": ".artifacts/p9-remed-02/security/sidecar.log", + "sha256": "9708d72e0b77497bae95abaf9de2f4999609fbb6f8f049bb8f16fbaa9ed8bc9a", + "bytes": 210 + }, + { + "path": ".artifacts/p9-remed-02/security/sidecar.xml", + "sha256": "86160173530de91c96bee058eeb229665a568e6d42ffc1630832af88f6c5b9bb", + "bytes": 33456 + }, + { + "path": ".artifacts/p9-remed-02/security/startup-proof.py", + "sha256": "5ada0b2ae4f4947d5edd5cf367b258ecb23c3f97a8a84a8008cd305a6cea285f", + "bytes": 4530 + }, + { + "path": ".artifacts/p9-remed-02/security/startup-server.log", + "sha256": "497cd4e4d40cdfb508ab814fc8140c5b4315157b651cf2d05037a5a54306e6b6", + "bytes": 536 + }, + { + "path": ".artifacts/p9-remed-02/security/startup.json", + "sha256": "2b3d70fcf08253063a8ce43bb4a2c45acd1e5d158d9727e66a342974c773479a", + "bytes": 3585 + }, + { + "path": ".artifacts/p9-remed-02/security/after/audit.py", + "sha256": "e046511f885440fada06bbf7f97af33b3868ca4ec2fd99eaed95fe32dab0467d", + "bytes": 6790 + }, + { + "path": ".artifacts/p9-remed-02/security/after/membership.json", + "sha256": "6324184789a9329ab8335ab41b34c3370092bf1c9025c6e24072b59baa8863e9", + "bytes": 3641 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-annotated-doc-0.request.json", + "sha256": "64226f8773eb6ba4adccafee464c9c127b4433e1e3bd45665c47c4f4b30feea7", + "bytes": 570 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-annotated-doc-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-annotated-types-0.request.json", + "sha256": "203999f458b4f5b233a2587221f75d167367a59c81afb1938db8be7595da9ff1", + "bytes": 576 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-annotated-types-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-anyio-0.request.json", + "sha256": "3ca9550d68c745f9224c9e7a86784277e6910217a61854b8614294b51387b4aa", + "bytes": 548 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-anyio-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-cachetools-0.request.json", + "sha256": "8f2710d0217775ea88fde0f2d5911ed6ebaad9c09da0ed2ff5678734cd621cb8", + "bytes": 561 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-cachetools-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-certifi-0.request.json", + "sha256": "06ae25f7a2a51b590cc17dce9cf7a8a4146e8c4f12c52a05fb7d270f90b747ca", + "bytes": 562 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-certifi-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-charset-normalizer-0.request.json", + "sha256": "bdf52eb4291164969f6776d7870082bca6c583c08bb642708986cc223ecca06f", + "bytes": 585 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-charset-normalizer-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-click-0.request.json", + "sha256": "74c9dace2ac60ea85b92618dc808e01138dc206520bb1e94194440e94a2b23bf", + "bytes": 546 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-click-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-fastapi-0.request.json", + "sha256": "f619fddc60323f9f9e4c400a1829525e2e1a8a3e564082e336817db0a6bd4361", + "bytes": 556 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-fastapi-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-filelock-0.request.json", + "sha256": "50d758927b921a79c313ed622c1bb1db28d32c826665092e686b9d8e72885931", + "bytes": 557 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-filelock-0.response", + "sha256": "2003396e959b9636c5f0546ffddd361c1d03965a6781982d3f816dd843f7a72c", + "bytes": 80072 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-fsspec-0.request.json", + "sha256": "3c0ec3977e876c17cde3750660408bf2bee0f5487ec74f99903a9f4b528e84aa", + "bytes": 555 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-fsspec-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-h11-0.request.json", + "sha256": "dee9d588ea077ba77c492a302565694f64d2b9bde6e4b9eb17ed115f5d30f61f", + "bytes": 542 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-h11-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-hf-xet-0.request.json", + "sha256": "da183f030c97fd1b5edc2f51761ec1bd43f87dffb09fb5369a31e0c0a8a7c368", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-hf-xet-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-httptools-0.request.json", + "sha256": "5e1ef9de9b14f166d384118ec567b6a19e0d76955ba81f95230acf3e14b5e3c4", + "bytes": 558 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-httptools-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-huggingface-hub-0.request.json", + "sha256": "a1219ca5b59ff85085ebe4a41a4c76d7e92b61d81379da497050038844b53e1b", + "bytes": 578 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-huggingface-hub-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-idna-0.request.json", + "sha256": "1b6eac2e684a4a23a286e2babcb9b719281cdf4458632f6da6f2870de9ee50f1", + "bytes": 541 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-idna-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-jinja2-0.request.json", + "sha256": "bcff9865054574bca2f0e5bf68d4c90913eda49821db8d820e8f6cc4f27a7164", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-jinja2-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-lxml-0.request.json", + "sha256": "3bdc385d3fb320cceb9b6a9bd3f8376ace41294a4c4cacd417c8778ed3460819", + "bytes": 543 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-lxml-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-markupsafe-0.request.json", + "sha256": "caff32568d4e559a460ae0864dc30c6aa2c7a86b64b602ea04ed1380ac6ac946", + "bytes": 561 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-markupsafe-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-mpmath-0.request.json", + "sha256": "958baf4b316c16d48fec33c59dc39144097c744e16b7021434fab74a4ce7fb11", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-mpmath-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-networkx-0.request.json", + "sha256": "2a2668f0854fd843a5d118ebc66b32ebf056081f037ab2e6139c4ea6d85c6a70", + "bytes": 555 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-networkx-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-numpy-0.request.json", + "sha256": "35daeeb0e17d71586f2767d75552c07ec50a3f13fbfcbde28130dfe969e91462", + "bytes": 546 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-numpy-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-packaging-0.request.json", + "sha256": "306ea9547d9cddbb5456e3a42c936e049a3b036e82a463b5dcd902a6dc7c2bd6", + "bytes": 556 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-packaging-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pillow-0.request.json", + "sha256": "c21e3c1181580203fffd7f1b3599c2a65e0199dc8dcbd0808bbbea844ae2509b", + "bytes": 551 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pillow-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pydantic-0.request.json", + "sha256": "b1b187d49aef446cae74f0241f02c5ad1bb89bb1dee5e34a0e8ecdcd78264506", + "bytes": 557 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pydantic-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pydantic-core-0.request.json", + "sha256": "1bd9f6c4c4e482032081c8e00b277656cb7c2eb0e1f22738ac05a21eb7d473cf", + "bytes": 572 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pydantic-core-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pymupdf-0.request.json", + "sha256": "4743696e2e226bbb9099d53da27dfefa0cba76607c0797f725daf379cae7d135", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pymupdf-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pypdf-0.request.json", + "sha256": "f3ad90b77340a5551dbc571dd794fea4a55fb191ca42f2dd6eea6db9767dc164", + "bytes": 548 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pypdf-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pytesseract-0.request.json", + "sha256": "b8c3c1b46348275f9651d53770bf7f744bc8fbdef4d8db3f05a01b31082ba02e", + "bytes": 566 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pytesseract-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-python-docx-0.request.json", + "sha256": "de226a29ccf239a16e42e370464f3a54f12aaff193a2ed4049aa7949160581aa", + "bytes": 564 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-python-docx-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-python-dotenv-0.request.json", + "sha256": "8bf346490f3e7b2e73c58bd012b058233eed7d83d2645b81759f9bf4064561e5", + "bytes": 570 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-python-dotenv-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-python-multipart-0.request.json", + "sha256": "b4b86bacc9eacce9e80a9cebc2c84af5b2febaaf5d3522839e7b114904e3cf20", + "bytes": 581 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-python-multipart-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pyyaml-0.request.json", + "sha256": "cbbb876ee7b94f455de2d2eaeb9aecf28f119176828518713b2a11bfba239b52", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-pyyaml-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-regex-0.request.json", + "sha256": "c9c4ebfbd27696ec7252c6ba08b00c6b29340e339c5215d210364ed4e1f3dc76", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-regex-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-requests-0.request.json", + "sha256": "c37fa097b66297a6442be92860db10d0467783a0ecaa4cce18cc64cf8a33f7bb", + "bytes": 557 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-requests-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-safetensors-0.request.json", + "sha256": "61122fbe41c3814723cb876e4bb4dd1e6e0d2ee95c0c17eef05ad648db9fea9f", + "bytes": 564 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-safetensors-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-setuptools-0.request.json", + "sha256": "b74a48d787d702a91849de2cd9887d8202d2c31c13727c087cb911f82ac3b6b3", + "bytes": 563 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-setuptools-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-starlette-0.request.json", + "sha256": "fa277b27a566f6888a6b6f0339fbecb3baa9399e5a4d6167dc1033d4ba7f308e", + "bytes": 558 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-starlette-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-sympy-0.request.json", + "sha256": "703af16696ca28b3090d8602b5eb68d460d5ff65f4cdba6f01ef469d71d2be80", + "bytes": 548 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-sympy-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-tokenizers-0.request.json", + "sha256": "aeebae1aa2794a573e8c1afd3a9d66c9a75e789db3c9bc32705b75ba3168223e", + "bytes": 563 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-tokenizers-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-torch-0.request.json", + "sha256": "1a88540d10512a2492d79f1ce7833484727facea0b8fde204e38396d1621be8c", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-torch-0.response", + "sha256": "a84af834befed64d3206d3c3a27a8f33d17bf7418ff842a3f6ba430f78dc2417", + "bytes": 34877 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-tqdm-0.request.json", + "sha256": "348f5301db41bd8ed5b2cae07e93c35100e636f34cff5b454ca5f5ce55efda87", + "bytes": 545 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-tqdm-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-transformers-0.request.json", + "sha256": "0387f5b776cb341fd7534559a64a6c5f42389406782f2c160008dc8c6236d831", + "bytes": 569 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-transformers-0.response", + "sha256": "42193f66bc1bb8b9f40f466490024790769c92b5815de3778408bbf7e42516ba", + "bytes": 128388 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-typing-extensions-0.request.json", + "sha256": "2e2a2431655996f7a4c2d275f422c6ff7fc01f6b08f1e890d768a96eefd2d727", + "bytes": 584 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-typing-extensions-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-typing-inspection-0.request.json", + "sha256": "5d38042f88366fee8b4e88f15ce4c3d7b490c96b51fef3f6b7a0122644ddca05", + "bytes": 582 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-typing-inspection-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-urllib3-0.request.json", + "sha256": "a322ebdf162ad602aa0d2efa0c2dc795fc62efb75b0517407afd3abf6ea33303", + "bytes": 552 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-urllib3-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-uvicorn-0.request.json", + "sha256": "add2f0647b81f668eca24f9d725ff88fce1afd78471ec8fd2bc0bb88fd7b7b8f", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-uvicorn-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-uvloop-0.request.json", + "sha256": "019f013dc69097527973ec2d519f9fab39fc9b98cade16e15ee47ccd61720b79", + "bytes": 551 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-uvloop-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-watchfiles-0.request.json", + "sha256": "8009019539de22466218707930b6777105107d7b01a064a0f8eeb8bb68219bec", + "bytes": 561 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-watchfiles-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-websockets-0.request.json", + "sha256": "8c71b0c58f779e7fe335319bac6b182acd2722c2de7a9f6fa6eb118cf98529ee", + "bytes": 559 + }, + { + "path": ".artifacts/p9-remed-02/security/after/osv-websockets-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-annotated-doc-0.request.json", + "sha256": "b6f0abc71cd6df38d8dd122e813398677a6afef4550bb761894840ecf3a221bf", + "bytes": 478 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-annotated-doc-0.response", + "sha256": "1aab691a5f37dd292e6d93ab53f7da5d839f56ba605345f017022ec75eb643af", + "bytes": 8643 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-annotated-types-0.request.json", + "sha256": "53b10f3c01a24301361401568a17489c86c43db9cbdacfb701a1f24f98d9fa54", + "bytes": 484 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-annotated-types-0.response", + "sha256": "a6e8e5b10c8fd2f596bba53e015cd37f6279fb5cec26ce0c5e9968625be4fefa", + "bytes": 17411 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-anyio-0.request.json", + "sha256": "acd20c2eeb6a0f63fa9f922564170e1c77e23fa33071b045e73c77571e4b9cd0", + "bytes": 456 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-anyio-0.response", + "sha256": "db8486b090bcf9977cd53888ffcd558fdf646d47887f656ab2eeeb0e9bb4cd06", + "bytes": 6826 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-cachetools-0.request.json", + "sha256": "6b5f5207848488b5df56223bc4e30505b23c0b23489dec33cd35cbd10ca0c51f", + "bytes": 469 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-cachetools-0.response", + "sha256": "99a6616752e72fd09c5b5cc35e079e725bb6daadd3afe77025a1a665ba5ccd40", + "bytes": 7631 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-certifi-0.request.json", + "sha256": "b456fd9f4a53024cfc785973ebc17dc70764a2616d412a4374744a95dd541fd5", + "bytes": 470 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-certifi-0.response", + "sha256": "ff912753725b147f8da6250d871b07cc801030bdee0b6e3ce1354ff8ddc6ed43", + "bytes": 4631 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-charset-normalizer-0.request.json", + "sha256": "5c3724404842986da90c13831c0e959d2c8665401b7f0b99f704007018108bc1", + "bytes": 493 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-charset-normalizer-0.response", + "sha256": "d023a4c812bc4478f294dbb8b9c7e5699c62a98ed0516129c22982f983d47f95", + "bytes": 201829 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-click-0.request.json", + "sha256": "1f1dc117b5a4c11c2da6f9d5e6a5353392f46ad6117ee916fedba7893feca490", + "bytes": 454 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-click-0.response", + "sha256": "4e36adc9b46f837e10ce801b7a478f9146fefdfb287292b7668fc64b1474e41d", + "bytes": 4722 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-fastapi-0.request.json", + "sha256": "04b4f80d9f6bd34c792eaaa8a77135d1505a79637442104278d13289eba169fa", + "bytes": 464 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-fastapi-0.response", + "sha256": "823a0938363b641629afe5ab40b0c131edf48f600dc6e7182fd92c4783241cc4", + "bytes": 29359 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-filelock-0.request.json", + "sha256": "08cc87f661608c8aec366a39763d045eff587d308f90b79bb3c13227c5ff4946", + "bytes": 465 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-filelock-0.response", + "sha256": "6dd7529f32a719bf84957a4015a06c6936075746ddeb6738534fce20f64e3d8c", + "bytes": 78359 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-fsspec-0.request.json", + "sha256": "6c5695d1b7c579b31eaae7fe4e206238aa8d4626b7f027ecdc166937f9470a55", + "bytes": 463 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-fsspec-0.response", + "sha256": "55eeed4d2aa6c53010b8dc6ac67ce83f2620ef17203c5922f5a642f479b484b0", + "bytes": 11291 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-h11-0.request.json", + "sha256": "18b2a17f9c5b526926f6003fc8aa57c22daff7e2f0490de6407aab962cef1abc", + "bytes": 450 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-h11-0.response", + "sha256": "97f4efb9cc00826f0408076983adc1a1e48e8f2cabf403aaf250f724e081440d", + "bytes": 10603 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-hf-xet-0.request.json", + "sha256": "56595139354f5260e6344e2086a690e727b9f8d06554098a7b653a0fb7250b23", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-hf-xet-0.response", + "sha256": "7a2f57e5d6d082478bcb46afb37fd7086c6471e7fa675bc50626b2c94fb57b14", + "bytes": 19854 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-httptools-0.request.json", + "sha256": "34e2313a13be3625926eaa08ef61f489340cbd81c2a55d74cce95122fed95752", + "bytes": 466 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-httptools-0.response", + "sha256": "e698f95358eb28b7cf1d1c0d33362c65e7aca3ca4613fecfc997362b7a8e6b78", + "bytes": 48073 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-huggingface-hub-0.request.json", + "sha256": "7b8b6f893b1c1fc5bf3979d257d283008c321653e62f0373fa24ff6c88e3fcfd", + "bytes": 486 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-huggingface-hub-0.response", + "sha256": "c609776b190cd8548ae4461362613739b3f69b3c6a32bf2b71d66a5718e6513e", + "bytes": 16010 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-idna-0.request.json", + "sha256": "802ee5bbd32e2c666f0cac0908b7a74add5923ef983125c6f4a302ed5c39f75c", + "bytes": 449 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-idna-0.response", + "sha256": "cf4ff5d748a88fe6e9d75ffbcc19b946d304b334dd10baa21bd90fb5566dfa44", + "bytes": 11179 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-jinja2-0.request.json", + "sha256": "4cd570bbbc1b1dcbe29a574cf923b35bb6ba6b65b029e965d8b6971d2e733aa8", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-jinja2-0.response", + "sha256": "1bc757d7065f3e67d3a49e72ebc731d0774055575732592eede9820c136329cc", + "bytes": 4925 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-lxml-0.request.json", + "sha256": "5bddb9e7495b9148db85d2e0f43b89304d88e8ecfbda5015af4d29ae8f2c2cb7", + "bytes": 451 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-lxml-0.response", + "sha256": "3c13b1696b8cbff457d15a210c7f0d0d0ecde9ec9e0deab3495c1c468115248e", + "bytes": 155127 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-markupsafe-0.request.json", + "sha256": "b6f4f67c647309c24949873c8b42af819104a3f26db3b264e7b4edbae5539fcf", + "bytes": 469 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-markupsafe-0.response", + "sha256": "0de4f18187d0fc2318de8504c4178f2297bc7cfa7a55adfb6d013190aff8cff4", + "bytes": 80718 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-mpmath-0.request.json", + "sha256": "bf7837cf46068d791d740c038a45e45db4b6ddbe84d0598ccc8e2a547a6810d3", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-mpmath-0.response", + "sha256": "87119e683fa33e0fcbca594469c138ecd42294fa5194f525c86787eefdfb77aa", + "bytes": 10700 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-networkx-0.request.json", + "sha256": "1f3ef84378a47af25778396530f9cd7af400a9ed2789dfc0bf18c9284aa4b530", + "bytes": 463 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-networkx-0.response", + "sha256": "086ea20eae0bce8c0100f4ad27141818546f904be441a713ce4c3a7f2d650d19", + "bytes": 8458 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-numpy-0.request.json", + "sha256": "709e6cb8c0ed83a7f7ddb44b59677f6a4b531df28853781d469a6374a8790a62", + "bytes": 454 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-numpy-0.response", + "sha256": "59a347f81abff9afe9053bbcc7b69a8b118dd896c5247b15396f1aac57dcf582", + "bytes": 68384 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-packaging-0.request.json", + "sha256": "f4de5e26a5cc33683660ce551853f3654e4aa11f25eee736897d6fd3855cfda8", + "bytes": 464 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-packaging-0.response", + "sha256": "4f190d2f0b312b3086058cee64ab4333bf3ce67fb78b4c2bdb43899049b29f4d", + "bytes": 5748 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pillow-0.request.json", + "sha256": "7e7a4cf6640dc72cb8b54ac26ecbb3c3b367e504631a6bab4e180e92a320263d", + "bytes": 459 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pillow-0.response", + "sha256": "183d4151cbc909acf39d4d5d48469d6bc66d5516e7f506854241839d0611b69e", + "bytes": 80892 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pydantic-0.request.json", + "sha256": "6603b6998f85e6c5b5277d163e45494c314c3cb81bc2117efe699cc700008368", + "bytes": 465 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pydantic-0.response", + "sha256": "a693ec5d0010fabf49738aad8cf11ad09be201ce44ff5c0a0880fe694255f503", + "bytes": 33109 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pydantic-core-0.request.json", + "sha256": "6cb03b677a000ef8b75438656eca943776b6368d28f306424e6fac9cc4d79e42", + "bytes": 480 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pydantic-core-0.response", + "sha256": "94728621efbe4a8fd535e56a92e0625becc78bfee22d5815a9a42ce6fb7c0be6", + "bytes": 95051 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pymupdf-0.request.json", + "sha256": "0bcceca9b653792b9d06f3c2825970d008785dbf9a37528b550c0ffa2107d741", + "bytes": 462 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pymupdf-0.response", + "sha256": "818d90f80b30a0dc22108307590a92405a7a89aef0524c9a364b27d5edac0937", + "bytes": 10735 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pypdf-0.request.json", + "sha256": "465b542fccfb14c2cfc6e225864a1421a35fe961cb8970dc07ff8cf00a595100", + "bytes": 456 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pypdf-0.response", + "sha256": "451120efbbfe4d789e0a41441a767ae87a3203c3871185fec82442948118ff3c", + "bytes": 9370 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pytesseract-0.request.json", + "sha256": "98b81326f6f05ee19ec409d8bbc430d5220cd012d18f828aab96e6b5dc25708b", + "bytes": 474 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pytesseract-0.response", + "sha256": "fcd07a9ea47cd7c63564da56020942d8db7556e7f665c448abb694a9c35c443e", + "bytes": 14261 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-python-docx-0.request.json", + "sha256": "3d30a4f95f98b82ac3c66de863853308d6fef89e160d99457cb2989a70d4fa0f", + "bytes": 472 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-python-docx-0.response", + "sha256": "9a7c0f17fb93b8cf7458de91e4398346c57e89b3ef7e199740f574a427e25998", + "bytes": 4049 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-python-dotenv-0.request.json", + "sha256": "c3cab1dd2fba3a5e7cf9aa49d8f152a82043ee2dc6b4690c990ffb25f46cb281", + "bytes": 478 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-python-dotenv-0.response", + "sha256": "5bbd730075bcfd67860e03d3bf67e844824e1b6e3df94c9b39c6556cff2ae193", + "bytes": 31961 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-python-multipart-0.request.json", + "sha256": "59e83cf0bfbd1a8617720a9d1c7aa3c25c514b5e227ad911dde2666e8b660a21", + "bytes": 489 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-python-multipart-0.response", + "sha256": "f94ae178a5196b01730490f0b3b10b2ad32bf92aa2fba5c3f7ffd6b5235c9697", + "bytes": 4230 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pyyaml-0.request.json", + "sha256": "352ae60f3689fb9e13b6a5f13935c4b2b0458e66829e811e264b64025d782718", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-pyyaml-0.response", + "sha256": "c3f35597bc2f08cc990c2a5fe57bef6687b3a3d7c61d8b0ba4cc067777eb1def", + "bytes": 66402 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-regex-0.request.json", + "sha256": "f39b2252782a40cdf1792bd63e223894aad20cff75cd7838edd1fd195e18a295", + "bytes": 462 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-regex-0.response", + "sha256": "1260cba012b40257442875816b3678a8fd78c7a9194509f1691784def12a366a", + "bytes": 142791 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-requests-0.request.json", + "sha256": "8463d2b5f1f537dfe4d43317f306aa4ec4a009316b99a0a951d7e4d6bd8edc3e", + "bytes": 465 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-requests-0.response", + "sha256": "8622e50ffd295ed759ec793f2a009172a4ed0204bbc5e948de23111bc3d2aeae", + "bytes": 6811 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-safetensors-0.request.json", + "sha256": "e0630beeeaf53349e3a559f2d6322b812e06a903a47f3200e46cef0744a681e6", + "bytes": 472 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-safetensors-0.response", + "sha256": "b8d395b433d0319498c9192ed323b86a84d82b5f40b4adf1b97b3bf8963fafad", + "bytes": 18780 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-setuptools-0.request.json", + "sha256": "e0c9664862518343efc2e7dfc6d0a683f60636dd3e240c8f5bd4640b6000efba", + "bytes": 471 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-setuptools-0.response", + "sha256": "75427bb7a4289a8f06fe176e3eab998710051b36706c80c1df7e796000372f02", + "bytes": 8162 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-starlette-0.request.json", + "sha256": "98cdadd8431eff98f0798be91a01f62b13c51a9f831624e3eb8e4c7d552bd7bc", + "bytes": 466 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-starlette-0.response", + "sha256": "f203a72cee50be4cc71d4fe8496b40c26d9a2f6fbde42b41d5a524d4b2c28940", + "bytes": 8469 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-sympy-0.request.json", + "sha256": "596702d3cb2b191d6cd8f16c329a200b247fc3efb46fc7164aa9ed28afa62a1d", + "bytes": 456 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-sympy-0.response", + "sha256": "2e71c3d308e376fd0b2a74f366d2850db2b9c1c73ffc5dcc293ba70caa711844", + "bytes": 14825 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-tokenizers-0.request.json", + "sha256": "f152c89e419eb781b96ed4ce6cae399b70e631a76e2ba927c176fadaf9cbdc3e", + "bytes": 471 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-tokenizers-0.response", + "sha256": "228ac30f6ea5afca9225ddf0ce1ff29891edf5677abfdeda5dba3f27275ec61c", + "bytes": 20361 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-torch-0.request.json", + "sha256": "96479ceec6d7a0d67d2bf254000b7f5ef29798a97359564e4fbf1a3907bd4e84", + "bytes": 489 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-torch-0.response", + "sha256": "b82014934f66beeb9e05a37f65357c4b50db0349d25d68d818ed0319dd4feb40", + "bytes": 24 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-tqdm-0.request.json", + "sha256": "f59439654b40954886ee92a2e5d4a6bbd224db4d7cf916a804926c2e8f793183", + "bytes": 453 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-tqdm-0.response", + "sha256": "2e987cad04ce7745797a04286ed00e2dc9bf4833e974dadce9913a0da753063d", + "bytes": 60675 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-transformers-0.request.json", + "sha256": "6af19e3138b50776144d9cab924af0152ffe2c9fc5f0d254c457fb39b94bf494", + "bytes": 477 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-transformers-0.response", + "sha256": "a40ad36f9253f91875d42d67d4b2a517a0ba509644a33a5511dd7723d3d6e86e", + "bytes": 74131 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-typing-extensions-0.request.json", + "sha256": "a7a54e093c34c64732a20f5746ac05a43e5574ab7ca2ee2661ebc78ef06cfbfb", + "bytes": 492 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-typing-extensions-0.response", + "sha256": "2140da00d62dde967f52d0be0ae28444f1d6a3fe603f52c83c23988c32122d5a", + "bytes": 5631 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-typing-inspection-0.request.json", + "sha256": "bf48bbe46b1651a63ad184fc1965a5ef195a53494b7b7db257a75bd755092d5c", + "bytes": 490 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-typing-inspection-0.response", + "sha256": "0605416f2f37f2df04e45360cf5ce4ca5eeca6d414bb6ddb1ec5a9893c62ac30", + "bytes": 4629 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-urllib3-0.request.json", + "sha256": "5cff6809332cd27513dc75d008e560d6301bb0b71f63fc27d2eeb5bd809f2c56", + "bytes": 460 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-urllib3-0.response", + "sha256": "5315e7401db3cacccd0c2ce5daf81f752a9cc3614b18c37f2b79930b7159ce2f", + "bytes": 9510 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-uvicorn-0.request.json", + "sha256": "d7f1f558a486202ef2bc50289759d5556004fa56dc9430bacbdddb27b235be12", + "bytes": 462 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-uvicorn-0.response", + "sha256": "a2d5cb56115dc317efc7ed5ae3724f94dec02d9253b1392ae546d426b62d4e30", + "bytes": 8627 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-uvloop-0.request.json", + "sha256": "07024d76cfef87437149b9b384e3e8dc29a5124bab9e1ae70bc99f1dc9d8ca38", + "bytes": 459 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-uvloop-0.response", + "sha256": "44ab0a28235cdf56de2375f92e81e7b491e5a3de114fa04538bee949e98e9051", + "bytes": 48745 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-watchfiles-0.request.json", + "sha256": "3395d69afaa516e21929b6b56843e1ea5ba1f6615a6b5bc9792fb9b8cd999308", + "bytes": 469 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-watchfiles-0.response", + "sha256": "178ddabbac1b454edc3c93620546cf25dfa9efbdadb28e63b912688963d1b068", + "bytes": 99179 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-websockets-0.request.json", + "sha256": "b64ac21e3bec48b1921a0457500518b0ebfb4a4ff884c5cfdb33649465aac870", + "bytes": 467 + }, + { + "path": ".artifacts/p9-remed-02/security/after/pypi-websockets-0.response", + "sha256": "adfcff5cc80bf02f0f41a4ac93ff685c1d49224cb0d561b45fcffd365875c0ce", + "bytes": 137519 + }, + { + "path": ".artifacts/p9-remed-02/security/after/summary.json", + "sha256": "ca66f5e1df3bf06d95a53d1f5c4734f948ee5a8c3a1618187fe63e4f8b3723f7", + "bytes": 796508 + }, + { + "path": ".artifacts/p9-remed-02/security/before/audit.py", + "sha256": "e046511f885440fada06bbf7f97af33b3868ca4ec2fd99eaed95fe32dab0467d", + "bytes": 6790 + }, + { + "path": ".artifacts/p9-remed-02/security/before/membership.json", + "sha256": "0bdb49caecaffdc8b34cff591c71e9748c5f850f0562815c6ce148181fad84f0", + "bytes": 3640 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-annotated-doc-0.request.json", + "sha256": "cfccb4868ab9c39f61f260f5b98c0b1bed9bc7dadcb4e9b9ff42975179c7549b", + "bytes": 570 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-annotated-doc-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-annotated-types-0.request.json", + "sha256": "fcf1246bae3d210d5da91bbe08cdf908719b6c04bae3c156a3f234d07184b916", + "bytes": 576 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-annotated-types-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-anyio-0.request.json", + "sha256": "dbeba2dd00f6d03050546e5cb76f8e701ca45a08df04c643f6b5ccdd88dfc433", + "bytes": 548 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-anyio-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-cachetools-0.request.json", + "sha256": "be910aa9c6f95b711bff39c9473a984e1dac06734bc97aa75561bbe1004428ab", + "bytes": 561 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-cachetools-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-certifi-0.request.json", + "sha256": "583019697a9cc43344f431e9c923c5d2965f2a98f5f77b85b1f6bac846e0708e", + "bytes": 560 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-certifi-0.response", + "sha256": "e03c073f18e5762ad6435bc2c07d9f1baf2607e242a9d32bb4b2e46975a26466", + "bytes": 5080 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-charset-normalizer-0.request.json", + "sha256": "89504e38f82f0caaedb8b9f2bfd19403f2a548ed885d8a52cb298fa075b06518", + "bytes": 585 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-charset-normalizer-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-click-0.request.json", + "sha256": "44b861fa69508c4748691a13a51ba19246fad0fd967d69fdf0a06b531d51b3d9", + "bytes": 546 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-click-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-fastapi-0.request.json", + "sha256": "1037cfd499a2671a37d2e72a32ad825060ad80966e21047daee61f111a88cb9a", + "bytes": 556 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-fastapi-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-filelock-0.request.json", + "sha256": "ca95e70f91f551d72fd92d9f14fcb13475fbca01eb55e761451f33cea23cc64a", + "bytes": 557 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-filelock-0.response", + "sha256": "6f0c97b5e13844cbb1c6fe8af51fc89e84895fc6fae38a3e739e23d3b902b6fc", + "bytes": 80072 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-fsspec-0.request.json", + "sha256": "07777aaa5dfd4d39c01f60daa72cee53936aade2e7f6588149f08e5e8cceafd9", + "bytes": 555 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-fsspec-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-h11-0.request.json", + "sha256": "c024ce9f7e9590d717691079a6fd6a68bf5a605b55fff57f1f7bb9ad811c196f", + "bytes": 542 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-h11-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-hf-xet-0.request.json", + "sha256": "c91231c21611d9e72f794fa00c2ed6044ac42137dc817ddb697cef5879bce598", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-hf-xet-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-httptools-0.request.json", + "sha256": "f414f708283efc63b84a485082d8d3cca5a89eaf9dfea6b425a66367334eb8b6", + "bytes": 558 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-httptools-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-huggingface-hub-0.request.json", + "sha256": "fcac2eeca3c1a18fb6fd67e9c3241f39a6bacc7abe7961b952487d39728b4f42", + "bytes": 578 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-huggingface-hub-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-idna-0.request.json", + "sha256": "602face6fdc7ce80ece312df15fb3994d88995974d1e82345b6abfd6b25edc4a", + "bytes": 541 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-idna-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-jinja2-0.request.json", + "sha256": "63d590bfe1b14f937c7297aafe41e157c6b65f664dcccc80b43eca21a5361203", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-jinja2-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-lxml-0.request.json", + "sha256": "03e00509284a8feb87a1a2897d7e510ce5194fd938583f538d383c22a3b61b4a", + "bytes": 543 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-lxml-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-markupsafe-0.request.json", + "sha256": "6ae6f7977b169333998ed85a8e334bc7ec55698bb82b19218bcf50587e2cb6fa", + "bytes": 561 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-markupsafe-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-mpmath-0.request.json", + "sha256": "d69d6d7d4ada508a59a6d950a24789956548432b79c41d8a761722ba63ad4bb8", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-mpmath-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-networkx-0.request.json", + "sha256": "412cb9208dcf3a53acbe106c85847e8a0b06262d657aae4715f37f6c5a63fa0b", + "bytes": 555 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-networkx-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-numpy-0.request.json", + "sha256": "34141f7700c29378e787e79dcfdce5e4896826a099924b6c88452a4ba92bb731", + "bytes": 546 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-numpy-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-packaging-0.request.json", + "sha256": "d1e1a8c4b51bedbc57c7f1881b8f9e6e421ee43eb875defb31f9769c5983a709", + "bytes": 556 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-packaging-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pillow-0.request.json", + "sha256": "ae3a76770246db1832c4fafbdc8d8cec4461f9b23fca85c172a5c7d51a600960", + "bytes": 551 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pillow-0.response", + "sha256": "80169154034f6c84ed3f4e8499b30b488e3e74fe698b7b35ba42640793754ba1", + "bytes": 574050 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pydantic-0.request.json", + "sha256": "a8e276ac9c1af5634a070b83668e00a95d26ae6f14c96c007d89e6b23749f05c", + "bytes": 557 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pydantic-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pydantic-core-0.request.json", + "sha256": "4164f17252f8f9c5d298bcdde2b9e4ae6e79b5fc755aa6bf2115be2a50700e88", + "bytes": 572 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pydantic-core-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pymupdf-0.request.json", + "sha256": "38e0958c536dc58f9514c0be18201384855dd12f09843ea7b268ef108c30d506", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pymupdf-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pypdf-0.request.json", + "sha256": "46f8b580d182dbc86900b9d399ea0ec9149dd7b31fd31576ea221c1be8f63c61", + "bytes": 548 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pypdf-0.response", + "sha256": "346463b6325953678ab7cae43ccb811e81a4721888c14a86d871e0bbfd79f020", + "bytes": 75251 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pytesseract-0.request.json", + "sha256": "ce4dbd4426fe21802a72e74be70f5089ecf7f542c6b9d835deb5209ff62b81c3", + "bytes": 566 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pytesseract-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-python-docx-0.request.json", + "sha256": "9a85a2787586547573616e52dc4654c4b0dcbd9a9c79f729096a8964dd24104d", + "bytes": 564 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-python-docx-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-python-dotenv-0.request.json", + "sha256": "15d3ed8b7c01dac0c69733c753e57d9b2d4cea63a05ccaf5872e4f675987e017", + "bytes": 570 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-python-dotenv-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-python-multipart-0.request.json", + "sha256": "372a3cc4a1dfc0677a9c6c19b1e6ad2780154a5c040d1152553fbbb55d15b2a3", + "bytes": 581 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-python-multipart-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pyyaml-0.request.json", + "sha256": "911782ae83d1831be38440d2d6ee8cbf4a6a2d7f2f7960012cd1d4873a1400eb", + "bytes": 549 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-pyyaml-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-regex-0.request.json", + "sha256": "6fcc4d5d133a25ddde79d24f766ec847d2e66f37dea955edbd63467b546aef08", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-regex-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-requests-0.request.json", + "sha256": "53e33df7ba8e4a24c34fe45a5e184927b6c8f1826c2e8d3c44552b020cb57b4b", + "bytes": 557 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-requests-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-safetensors-0.request.json", + "sha256": "234cba8ed16e281c11a070778909c0eaba8bed628833286529d6cff7a4dee5fd", + "bytes": 564 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-safetensors-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-setuptools-0.request.json", + "sha256": "53dcc195e5c3510c8e32f01683b39f11b3fe6ef728162b73ad5d87a860689d3f", + "bytes": 563 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-setuptools-0.response", + "sha256": "d3bfa8422b211966627e2dc54ad5369f3d8acc0d0fe2a7554d9cd3a302b11854", + "bytes": 6992 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-starlette-0.request.json", + "sha256": "4ae229b5d9fbbdb54cdd3b90cb9f55ce08d48cd9da9fba6c18147067817ffdaf", + "bytes": 558 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-starlette-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-sympy-0.request.json", + "sha256": "01f7937a724f2f1cf9e9ca2a1f8eaf7106ecc321691d06669a604bcfb219faf2", + "bytes": 548 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-sympy-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-tokenizers-0.request.json", + "sha256": "98267124194802fefb12cd4f5e6dbaae3f53e5d4f5c825b6c522198d6da3d9ca", + "bytes": 563 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-tokenizers-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-torch-0.request.json", + "sha256": "de7344ce4805f41a775724534c9e8f87fa717d9b594c77ea48f4217f136cb580", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-torch-0.response", + "sha256": "ed856c1e9f67d45b5da777d771fadce1ceb0c4c860bf6478c2ab111e8aa38467", + "bytes": 34877 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-tqdm-0.request.json", + "sha256": "afba64f13627365f02cff3eee23b48c5a5100f086c0e862b5fee69262e0d679f", + "bytes": 545 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-tqdm-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-transformers-0.request.json", + "sha256": "dd6842a9a9545495e2845fb7f8fb9c590000489232e0be2ca1e6cbef287a3d9d", + "bytes": 569 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-transformers-0.response", + "sha256": "09ae6d7b9a15811a500ba718a6b95c74a2da71a9d731c82020cf260c1e520194", + "bytes": 128388 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-typing-extensions-0.request.json", + "sha256": "6e996f5f1e81127589a38f59fe050e415d00ab37fd80d48ae3d6a02855636698", + "bytes": 584 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-typing-extensions-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-typing-inspection-0.request.json", + "sha256": "f2e2ad16fc60f08d53fce4821ce9dfd6c84fcf6388f8e250420f7924830c19e3", + "bytes": 582 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-typing-inspection-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-urllib3-0.request.json", + "sha256": "9b85c150301bbbfcc550c00916146f0d6cc1a521aebcba3b0db25b6169c1a7bc", + "bytes": 552 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-urllib3-0.response", + "sha256": "35c1090cc42292ff19ac6cf6551afc6cbab091db1aed3849a81eefaf372fc382", + "bytes": 30574 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-uvicorn-0.request.json", + "sha256": "0e12948a295a8c95dd2060ff3cb31e626b1648a72ced525a4bcce67726ad8f40", + "bytes": 554 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-uvicorn-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-uvloop-0.request.json", + "sha256": "e378667bf12f607b70a6eba20f2add88cbd5c7498cd2ad92b865d9e3338bd469", + "bytes": 551 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-uvloop-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-watchfiles-0.request.json", + "sha256": "7da066d06808e70a33dec62549d16d884f7038a617dd68eb61ad14e9bbf90f1f", + "bytes": 561 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-watchfiles-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-websockets-0.request.json", + "sha256": "ec59288d27f52c6f897ca42a5f79de884ab8055a259eea49b51f5e3d3fd092cd", + "bytes": 559 + }, + { + "path": ".artifacts/p9-remed-02/security/before/osv-websockets-0.response", + "sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", + "bytes": 2 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-annotated-doc-0.request.json", + "sha256": "935a1a396006f01d75473c6355203ad4ba5b1104d3611a75bbde721feb445703", + "bytes": 478 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-annotated-doc-0.response", + "sha256": "1aab691a5f37dd292e6d93ab53f7da5d839f56ba605345f017022ec75eb643af", + "bytes": 8643 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-annotated-types-0.request.json", + "sha256": "ce10be5a191da27f5195ec11d1d04f236dc24e08d26a6a0a7666abde7bf21812", + "bytes": 484 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-annotated-types-0.response", + "sha256": "a6e8e5b10c8fd2f596bba53e015cd37f6279fb5cec26ce0c5e9968625be4fefa", + "bytes": 17411 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-anyio-0.request.json", + "sha256": "2e41c7826c519f447c242f070b1408aa3624a968a900c2e081fe8d3db0ca1131", + "bytes": 456 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-anyio-0.response", + "sha256": "db8486b090bcf9977cd53888ffcd558fdf646d47887f656ab2eeeb0e9bb4cd06", + "bytes": 6826 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-cachetools-0.request.json", + "sha256": "44561511dffb0726359a638ac788cb86e855962364dbfb20241c24c913186dff", + "bytes": 469 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-cachetools-0.response", + "sha256": "99a6616752e72fd09c5b5cc35e079e725bb6daadd3afe77025a1a665ba5ccd40", + "bytes": 7631 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-certifi-0.request.json", + "sha256": "bc3e111c796e09956280ef0230168a2e4208756963e4df9f5b3e65618812f647", + "bytes": 468 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-certifi-0.response", + "sha256": "c65938c867536616d6755e3b1fded46639e940ea2b2ce6e792aaa6fe64fc55f5", + "bytes": 6498 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-charset-normalizer-0.request.json", + "sha256": "edcf1525af83d4a6dea7e65faf3266d43da1252bf7d2d1b70faab57350d8502c", + "bytes": 493 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-charset-normalizer-0.response", + "sha256": "d023a4c812bc4478f294dbb8b9c7e5699c62a98ed0516129c22982f983d47f95", + "bytes": 201829 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-click-0.request.json", + "sha256": "49d26d4ff39f15ae52c79621a9101c8a901b568875bfc660eb5a986c793e1f7f", + "bytes": 454 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-click-0.response", + "sha256": "4e36adc9b46f837e10ce801b7a478f9146fefdfb287292b7668fc64b1474e41d", + "bytes": 4722 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-fastapi-0.request.json", + "sha256": "d0484da0659daac808d50ddfdb8a5356516d39291d88b8bee84ca155a3bf97fb", + "bytes": 464 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-fastapi-0.response", + "sha256": "823a0938363b641629afe5ab40b0c131edf48f600dc6e7182fd92c4783241cc4", + "bytes": 29359 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-filelock-0.request.json", + "sha256": "44c92c9aab898bbfb5f297bfd016ac2f369bb2bf9485d55add749013425caf46", + "bytes": 465 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-filelock-0.response", + "sha256": "6dd7529f32a719bf84957a4015a06c6936075746ddeb6738534fce20f64e3d8c", + "bytes": 78359 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-fsspec-0.request.json", + "sha256": "1fdff7625fdc3369c37078d99ace15eb13f72bdd3ed1bb2600ccb25f87a0ec98", + "bytes": 463 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-fsspec-0.response", + "sha256": "55eeed4d2aa6c53010b8dc6ac67ce83f2620ef17203c5922f5a642f479b484b0", + "bytes": 11291 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-h11-0.request.json", + "sha256": "2b3242251a3521f800426218ef638ef527d24ad6f3747170d0ebdef24fa65ed8", + "bytes": 450 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-h11-0.response", + "sha256": "97f4efb9cc00826f0408076983adc1a1e48e8f2cabf403aaf250f724e081440d", + "bytes": 10603 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-hf-xet-0.request.json", + "sha256": "dad1ecefa124bba9b3fad5412d35f12609ec7ca5390a25eb5ea736080cfbe37b", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-hf-xet-0.response", + "sha256": "7a2f57e5d6d082478bcb46afb37fd7086c6471e7fa675bc50626b2c94fb57b14", + "bytes": 19854 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-httptools-0.request.json", + "sha256": "dadcb6c1bfedebb25d0a04354b494c4438bcc348d89c8ff37fb4c37bb9cffed8", + "bytes": 466 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-httptools-0.response", + "sha256": "e698f95358eb28b7cf1d1c0d33362c65e7aca3ca4613fecfc997362b7a8e6b78", + "bytes": 48073 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-huggingface-hub-0.request.json", + "sha256": "43e30c76f5fec85c26c8effccf37fe4b295ed2db6781febb2332ffbae503a6c0", + "bytes": 486 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-huggingface-hub-0.response", + "sha256": "c609776b190cd8548ae4461362613739b3f69b3c6a32bf2b71d66a5718e6513e", + "bytes": 16010 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-idna-0.request.json", + "sha256": "67afe234872e759320168f6dd6ce4509cfdb00e65c4ef028c79a4ceed5fa0b85", + "bytes": 449 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-idna-0.response", + "sha256": "cf4ff5d748a88fe6e9d75ffbcc19b946d304b334dd10baa21bd90fb5566dfa44", + "bytes": 11179 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-jinja2-0.request.json", + "sha256": "6b071bca8e11e81ea4969fb268d37eb98641efc01af70b057f0c6b2b6db6b8c6", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-jinja2-0.response", + "sha256": "1bc757d7065f3e67d3a49e72ebc731d0774055575732592eede9820c136329cc", + "bytes": 4925 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-lxml-0.request.json", + "sha256": "d18fa1c39ff228c083bd42fbff7590370bfc19ac56b96d04faddabce2374bb3f", + "bytes": 451 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-lxml-0.response", + "sha256": "3c13b1696b8cbff457d15a210c7f0d0d0ecde9ec9e0deab3495c1c468115248e", + "bytes": 155127 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-markupsafe-0.request.json", + "sha256": "18bb7397e2b37ce217d936b9a7556b70ff47d7580e867a2044bd9caef0b211cf", + "bytes": 469 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-markupsafe-0.response", + "sha256": "0de4f18187d0fc2318de8504c4178f2297bc7cfa7a55adfb6d013190aff8cff4", + "bytes": 80718 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-mpmath-0.request.json", + "sha256": "438ea6cf021380532d0ab83c9f2a38225b671e9aeb586afe1a0c4c6f5b51bbb7", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-mpmath-0.response", + "sha256": "87119e683fa33e0fcbca594469c138ecd42294fa5194f525c86787eefdfb77aa", + "bytes": 10700 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-networkx-0.request.json", + "sha256": "89e7d9151376596e5ae7c52d677af2a11898decc41161314e0486cd0556c70fc", + "bytes": 463 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-networkx-0.response", + "sha256": "086ea20eae0bce8c0100f4ad27141818546f904be441a713ce4c3a7f2d650d19", + "bytes": 8458 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-numpy-0.request.json", + "sha256": "5f00ebd862a020bf7070e270a91a50839a92885dfc693559b620aedac4a9ce1a", + "bytes": 454 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-numpy-0.response", + "sha256": "59a347f81abff9afe9053bbcc7b69a8b118dd896c5247b15396f1aac57dcf582", + "bytes": 68384 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-packaging-0.request.json", + "sha256": "88d32d2195e59168a359871b430bc258e755c5a6f47e2b97c1147238a757d177", + "bytes": 464 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-packaging-0.response", + "sha256": "4f190d2f0b312b3086058cee64ab4333bf3ce67fb78b4c2bdb43899049b29f4d", + "bytes": 5748 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pillow-0.request.json", + "sha256": "f5b93cc1a6f2330ad672759568ff0d4cc7856b34ea625e6dd6c70e6ed5e05659", + "bytes": 459 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pillow-0.response", + "sha256": "56ca2c3f9e7460b8a47c3f694a02b000ec11811e392522df879c291a20198073", + "bytes": 495641 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pydantic-0.request.json", + "sha256": "4b2f2ebc2d7eb50fd44785f7b81b669b061cd5114db439ec4890b2f705f140a8", + "bytes": 465 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pydantic-0.response", + "sha256": "a693ec5d0010fabf49738aad8cf11ad09be201ce44ff5c0a0880fe694255f503", + "bytes": 33109 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pydantic-core-0.request.json", + "sha256": "71d19c0893a7b5eacd80e784b3fe1d77e40480bed220a86f8051a8cdde245f51", + "bytes": 480 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pydantic-core-0.response", + "sha256": "94728621efbe4a8fd535e56a92e0625becc78bfee22d5815a9a42ce6fb7c0be6", + "bytes": 95051 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pymupdf-0.request.json", + "sha256": "025471565c310c01088ea0735c14e6a89f7d2b7eef8c9047715993d75fe6ae00", + "bytes": 462 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pymupdf-0.response", + "sha256": "818d90f80b30a0dc22108307590a92405a7a89aef0524c9a364b27d5edac0937", + "bytes": 10735 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pypdf-0.request.json", + "sha256": "5245740189f55cd4522bc9a40934d99e617cda26a695ac8cd1d45f99c3e890ae", + "bytes": 456 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pypdf-0.response", + "sha256": "66418be6194b168297f8f26703b2bbee4acca41f801978190b841f61227a8c63", + "bytes": 27376 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pytesseract-0.request.json", + "sha256": "b606f72d7af83ffa0a06a68251fc3e9174f54a282eb149264646c902af549ce0", + "bytes": 474 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pytesseract-0.response", + "sha256": "fcd07a9ea47cd7c63564da56020942d8db7556e7f665c448abb694a9c35c443e", + "bytes": 14261 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-python-docx-0.request.json", + "sha256": "529d8db1cbc487baa79b95d0336698d9206dc29920a100dee1bfbb70e663bfbe", + "bytes": 472 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-python-docx-0.response", + "sha256": "9a7c0f17fb93b8cf7458de91e4398346c57e89b3ef7e199740f574a427e25998", + "bytes": 4049 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-python-dotenv-0.request.json", + "sha256": "922ad96c0b2728ccf782829ff8a379db5d689e0c15419a9a1f348e0944e50410", + "bytes": 478 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-python-dotenv-0.response", + "sha256": "5bbd730075bcfd67860e03d3bf67e844824e1b6e3df94c9b39c6556cff2ae193", + "bytes": 31961 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-python-multipart-0.request.json", + "sha256": "12f116f6a4a3333e7ac71c6a609e5c20f5910604ac2f45f10e6440b546197470", + "bytes": 489 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-python-multipart-0.response", + "sha256": "f94ae178a5196b01730490f0b3b10b2ad32bf92aa2fba5c3f7ffd6b5235c9697", + "bytes": 4230 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pyyaml-0.request.json", + "sha256": "8d0fdc602eccc07ace87544d94a9c24541c965667d667ac0759d0ef9f01398f8", + "bytes": 457 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-pyyaml-0.response", + "sha256": "c3f35597bc2f08cc990c2a5fe57bef6687b3a3d7c61d8b0ba4cc067777eb1def", + "bytes": 66402 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-regex-0.request.json", + "sha256": "9c7ef95e4ddc354f7a4e9f6b0ae27335a3d26f09cbcf72c083e103c28054223e", + "bytes": 462 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-regex-0.response", + "sha256": "1260cba012b40257442875816b3678a8fd78c7a9194509f1691784def12a366a", + "bytes": 142791 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-requests-0.request.json", + "sha256": "db0411be7b2f54e844cee30bac929d275ee45558a03151275c80404e6718c6dd", + "bytes": 465 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-requests-0.response", + "sha256": "8622e50ffd295ed759ec793f2a009172a4ed0204bbc5e948de23111bc3d2aeae", + "bytes": 6811 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-safetensors-0.request.json", + "sha256": "fa9587c4a0e975f151f7569aff01d818bd416325475fe34f795d06a48caf0479", + "bytes": 472 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-safetensors-0.response", + "sha256": "b8d395b433d0319498c9192ed323b86a84d82b5f40b4adf1b97b3bf8963fafad", + "bytes": 18780 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-setuptools-0.request.json", + "sha256": "c7eb45efc3d48a42a8a3414f52211e7d4d7a2d8683ae5c9702e576c1de52b3aa", + "bytes": 471 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-setuptools-0.response", + "sha256": "fc55c3c123a680b2f77f3071bc028741023be1c67f076b878907e5a3823b2dbd", + "bytes": 11090 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-starlette-0.request.json", + "sha256": "f457ec31490c799dc9ae6de202bb6a6f592c557cb6fda3e789969ed27ee18bcf", + "bytes": 466 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-starlette-0.response", + "sha256": "f203a72cee50be4cc71d4fe8496b40c26d9a2f6fbde42b41d5a524d4b2c28940", + "bytes": 8469 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-sympy-0.request.json", + "sha256": "d921d1f37c35bdf7c792d1679e324ebbf7f72cdd021bc61eaf79a6e2569100fc", + "bytes": 456 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-sympy-0.response", + "sha256": "2e71c3d308e376fd0b2a74f366d2850db2b9c1c73ffc5dcc293ba70caa711844", + "bytes": 14825 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-tokenizers-0.request.json", + "sha256": "bf258aa5396556c2bb62fd491dae37b1202c526b50a20755b63469aa056e101e", + "bytes": 471 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-tokenizers-0.response", + "sha256": "228ac30f6ea5afca9225ddf0ce1ff29891edf5677abfdeda5dba3f27275ec61c", + "bytes": 20361 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-torch-0.request.json", + "sha256": "127a709aed1d3b886a11d87a96b04e0d45dd79ca7caefc0d1e9a8baa8a26cc15", + "bytes": 489 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-torch-0.response", + "sha256": "b82014934f66beeb9e05a37f65357c4b50db0349d25d68d818ed0319dd4feb40", + "bytes": 24 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-tqdm-0.request.json", + "sha256": "e1595db9e1470beaaa4641f49b39cb613f8365898a158e95053e33be6ddd9071", + "bytes": 453 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-tqdm-0.response", + "sha256": "2e987cad04ce7745797a04286ed00e2dc9bf4833e974dadce9913a0da753063d", + "bytes": 60675 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-transformers-0.request.json", + "sha256": "e0e40be3d41bdeac466d42a0d2ef27e6c41e3417e7ff9cf25571fb489d370d03", + "bytes": 477 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-transformers-0.response", + "sha256": "a40ad36f9253f91875d42d67d4b2a517a0ba509644a33a5511dd7723d3d6e86e", + "bytes": 74131 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-typing-extensions-0.request.json", + "sha256": "7768c4b72fcd8e5a647846d65895fdc87778017eac9610ec515ae29d9932b67c", + "bytes": 492 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-typing-extensions-0.response", + "sha256": "2140da00d62dde967f52d0be0ae28444f1d6a3fe603f52c83c23988c32122d5a", + "bytes": 5631 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-typing-inspection-0.request.json", + "sha256": "312f6a481b9299d675dc1fcb78b57a4baf89b7efaed91a8c0bfd252a801b5dc0", + "bytes": 490 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-typing-inspection-0.response", + "sha256": "0605416f2f37f2df04e45360cf5ce4ca5eeca6d414bb6ddb1ec5a9893c62ac30", + "bytes": 4629 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-urllib3-0.request.json", + "sha256": "dbd5a5dadeb13f9ab5902ab6ae43c918a6059be7d94c7bfd59eb409af4b19ac1", + "bytes": 460 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-urllib3-0.response", + "sha256": "54db1e362e04e390c23c2182dd425a6b3f0c1a73c5bd3f3e40611c3590c7a43a", + "bytes": 30292 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-uvicorn-0.request.json", + "sha256": "1276957e50f2c8e79327a66532b495ab458df1406b23611cc7c60b3e15bdd45d", + "bytes": 462 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-uvicorn-0.response", + "sha256": "a2d5cb56115dc317efc7ed5ae3724f94dec02d9253b1392ae546d426b62d4e30", + "bytes": 8627 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-uvloop-0.request.json", + "sha256": "ccac0231c6736f049fbb337e1f34f3ba1a5a33722631666499d56666f4aea156", + "bytes": 459 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-uvloop-0.response", + "sha256": "44ab0a28235cdf56de2375f92e81e7b491e5a3de114fa04538bee949e98e9051", + "bytes": 48745 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-watchfiles-0.request.json", + "sha256": "ec97e6461c32d321ddc714ae755c4a0a73d0e7fea34f8886658ba92a5b45ba51", + "bytes": 469 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-watchfiles-0.response", + "sha256": "178ddabbac1b454edc3c93620546cf25dfa9efbdadb28e63b912688963d1b068", + "bytes": 99179 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-websockets-0.request.json", + "sha256": "64b86f2efb6e47511315967b7e405695bb027cc513e1c32aa71e4030bc9047d0", + "bytes": 467 + }, + { + "path": ".artifacts/p9-remed-02/security/before/pypi-websockets-0.response", + "sha256": "adfcff5cc80bf02f0f41a4ac93ff685c1d49224cb0d561b45fcffd365875c0ce", + "bytes": 137519 + }, + { + "path": ".artifacts/p9-remed-02/security/before/summary.json", + "sha256": "c5c1185537f6ae6029d538d1241ca8479966097572442c3dea9f211bdd2d1500", + "bytes": 1566169 + } + ] +} diff --git a/docs/redesign/phase-9/p9-remed-02/security/validation.json b/docs/redesign/phase-9/p9-remed-02/security/validation.json new file mode 100644 index 0000000..8d36c6c --- /dev/null +++ b/docs/redesign/phase-9/p9-remed-02/security/validation.json @@ -0,0 +1,142 @@ +{ + "schemaVersion": 1, + "observedUtc": "2026-10-24T17:09:44.302477+00:00", + "gate": "BLOCKED", + "applicationSourceChanged": false, + "modelDownloaded": false, + "productionAccess": false, + "sidecar": { + "passed": 58, + "failed": 0, + "skipped": 0, + "report": { + "path": ".artifacts/p9-remed-02/security/sidecar.xml", + "sha256": "86160173530de91c96bee058eeb229665a568e6d42ffc1630832af88f6c5b9bb", + "bytes": 33456 + }, + "process": { + "command": [ + "E:\\Storage\\Projects\\Active\\Job tracker\\tools\\summarizer\\.venv\\Scripts\\python.exe", + "-m", + "pytest", + "-q", + "tests", + "--junitxml=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-remed-02\\security\\sidecar.xml" + ], + "exitCode": 0, + "startedUtc": "2026-10-24T17:01:50.178400+00:00", + "finishedUtc": "2026-10-24T17:02:11.534863+00:00", + "modelLoadingDisabled": true + } + }, + "parserRed": { + "passed": 1, + "failed": 1, + "expectedFailure": "APNG rejected-canvas allocated before bomb check", + "evidence": { + "path": ".artifacts/p9-remed-02/security/parser-red.log", + "sha256": "414e669f431c500345b9a316e5ff50532eb6f3d5652274d9f7cfc2fdcd0bef2c", + "bytes": 1964 + } + }, + "startup": { + "status": "PASS", + "httpFiles": 3, + "unauthenticatedUploadStatus": 401, + "serverStopped": true, + "evidence": { + "path": ".artifacts/p9-remed-02/security/startup.json", + "sha256": "2b3d70fcf08253063a8ce43bb4a2c45acd1e5d158d9727e66a342974c773479a", + "bytes": 3585 + } + }, + "linuxParser": { + "exitCode": 0, + "imageId": "sha256:9aaa3eca161dca35243cb8083f83706b852bbee7a24bcf3a035fbe2af1f547f3", + "containerAbsent": true, + "regressionCases": 2, + "childDecodes": 3, + "fullSidecarGraph": false, + "ocr": false, + "modelInference": false, + "evidence": { + "path": ".artifacts/p9-remed-02/security/linux-parser.json", + "sha256": "311ddccad8a801025e0fd985f72d816595c6f96560974ab1d4e7fc661ba3f597", + "bytes": 3213 + } + }, + "dependencyGraph": { + "pins": 49, + "changed": { + "pypdf": { + "before": "6.16.2", + "after": "6.21.2" + }, + "urllib3": { + "before": "2.7.0", + "after": "2.8.0" + }, + "setuptools": { + "before": "84.0.0", + "after": "84.1.0" + }, + "pillow": { + "before": "12.3.0", + "after": "13.0.0" + }, + "certifi": { + "before": "2026.7.22", + "after": "2026.10.19" + } + }, + "lock": { + "path": "tools/summarizer/requirements-linux.lock", + "sha256": "23f200fef330e2677ff4a47e5fcbaa327f98c3d4ebdcf73e2047e9f61664e7cb", + "bytes": 119391 + }, + "source": { + "path": "tools/summarizer/requirements.txt", + "sha256": "292badbfbf50aa82bf9c4f0ccf73559ddef832c990b90cdff00732f7162e5209", + "bytes": 383 + } + }, + "inventory": { + "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", + "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", + "bytes": 794994 + }, + "accounting": { + "beforeRecords": 249, + "beforeGroups": 109, + "afterRecords": 99, + "afterGroups": 44, + "remediatedGroups": 65 + }, + "linuxWheels": [ + { + "wheel": "certifi-2026.10.19-py3-none-any.whl", + "sha256": "42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", + "presentInHashLock": true + }, + { + "wheel": "pillow-13.0.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", + "sha256": "42d63be3af4f9b951b199b0a9d23365d37ab14687e6d77b74940432c8515c4ca", + "presentInHashLock": true + }, + { + "wheel": "pypdf-6.21.2-py3-none-any.whl", + "sha256": "1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084", + "presentInHashLock": true + }, + { + "wheel": "setuptools-84.1.0-py3-none-any.whl", + "sha256": "5231689c6ac8156cd155cfb98c3fd6fb252c3e7e9bd3d78b64d3c55f132624c9", + "presentInHashLock": true + }, + { + "wheel": "urllib3-2.8.0-py3-none-any.whl", + "sha256": "0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", + "presentInHashLock": true + } + ] +} diff --git a/tools/summarizer/requirements-linux.lock b/tools/summarizer/requirements-linux.lock index a3533ca..6e5fe81 100644 --- a/tools/summarizer/requirements-linux.lock +++ b/tools/summarizer/requirements-linux.lock @@ -18,10 +18,12 @@ cachetools==5.5.2 \ --hash=sha256:1a661caa9175d26759571b2e19580f9d6393969e5dfca11fdb1f947a23e640d4 \ --hash=sha256:d26a22bcc62eb95c3beabd9f1ee5e820d3d2704fe2967cbe350e20c8ffcd3f0a # via -r requirements.txt -certifi==2026.7.22 \ - --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ - --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 - # via requests +certifi==2026.10.19 \ + --hash=sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae \ + --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b + # via + # -r requirements.txt + # requests charset-normalizer==3.5.1 \ --hash=sha256:00668ebb0609751758682eb0b5857e7c35b9f00e84dfdef062e103244ec94d45 \ --hash=sha256:012a22b88a77ca2e59b98ac5889b0deb604147666032f45e6d6e217634d2550d \ @@ -666,94 +668,90 @@ packaging==26.3 \ # huggingface-hub # pytesseract # transformers -pillow==12.3.0 \ - --hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 \ - --hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a \ - --hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 \ - --hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 \ - --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \ - --hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df \ - --hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 \ - --hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b \ - --hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 \ - --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \ - --hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 \ - --hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 \ - --hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 \ - --hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 \ - --hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 \ - --hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 \ - --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \ - --hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d \ - --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \ - --hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed \ - --hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace \ - --hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb \ - --hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 \ - --hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 \ - --hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 \ - --hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 \ - --hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce \ - --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \ - --hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e \ - --hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c \ - --hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 \ - --hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace \ - --hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c \ - --hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f \ - --hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 \ - --hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f \ - --hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a \ - --hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 \ - --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \ - --hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 \ - --hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a \ - --hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 \ - --hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e \ - --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \ - --hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 \ - --hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 \ - --hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 \ - --hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 \ - --hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 \ - --hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a \ - --hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c \ - --hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 \ - --hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 \ - --hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 \ - --hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 \ - --hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f \ - --hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec \ - --hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a \ - --hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 \ - --hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 \ - --hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b \ - --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \ - --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \ - --hash=sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd \ - --hash=sha256:bcc33feacfaefce60c12fd500a277533bdc02b10a19f7f6d348763d8140bbba7 \ - --hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \ - --hash=sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777 \ - --hash=sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35 \ - --hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \ - --hash=sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f \ - --hash=sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f \ - --hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \ - --hash=sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c \ - --hash=sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71 \ - --hash=sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3 \ - --hash=sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838 \ - --hash=sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf \ - --hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \ - --hash=sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26 \ - --hash=sha256:f0606c8bf2cdefea14a43530f7657cbbb7ecf1c4222512492ef4a4434a9501ec \ - --hash=sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9 \ - --hash=sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65 \ - --hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \ - --hash=sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e \ - --hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \ - --hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198 \ - --hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7 +pillow==13.0.0 \ + --hash=sha256:02464da86f561f410e13b061ec37c3068a9cb557a095494157742d07b3c24a27 \ + --hash=sha256:04a63720f79e22fd54d897c233a68314c50ca0603360f54ce2bd5db8f0f43782 \ + --hash=sha256:05cd2cd39055d0b9650060e4513ef4a9a0aea870083950bd046a0d6490f93a22 \ + --hash=sha256:06903aac074d00c988e77a1fc435286dc498506d4ca8d6f69df9babddf4ecc15 \ + --hash=sha256:08b826a9bf1265c76de04a42061d61ea6b109418b7826f28ff1ecdfaa26c5502 \ + --hash=sha256:0d1a9cf7bc6917538b20f8d06b9ab2147e542f68849e96fc58eb66bdf6acc692 \ + --hash=sha256:10b5019883c98f1dd819ca48ffc6f33a91cee04948fe637c605f4345c7cafd6f \ + --hash=sha256:12b0fa15879fe5a9d9eebe66e4e2d74128a773b1a4448010c9c714f45e04b9d8 \ + --hash=sha256:12fbb851cf323cc19aac3eea1df5ad17b57e91e9fe3cfd06100dba7bb8208c13 \ + --hash=sha256:149a1c323ba366f90b48e6f1a6db6582eb50512df374588de56fc909abc0f0f3 \ + --hash=sha256:19b66ca0a4d25cc0200b381ce824c7ea090db61427315e73cfb05dbf1b35c369 \ + --hash=sha256:1c774b9c0ba0d0b356f71530677b39028878a2cae5a93e0a13779cfd17120f88 \ + --hash=sha256:20722cd5375533ad754053363a80b8fb30c79d37930a6f7228030e237ce3bd5d \ + --hash=sha256:20822140c9a2ba9c5e42df342b0a892ab2e102fc0e3db967a133bb9ce3f898bb \ + --hash=sha256:21c32061a5512dc13f87cc7303e120e4d77c2f70df89a35af0e3ce246e5ac57f \ + --hash=sha256:2310e2adfc13c6d457d7d0f2ffdd5c56a74a317650cf765887df8d515a647ac0 \ + --hash=sha256:23edf4ec4b6f4f240e8df6e4985e9ee2ced86474632433e55fb1e2548744bf40 \ + --hash=sha256:2d50500a4a3bc6469adcdb319cf05d688b08ca3bf0f22a05339f3b25b433a599 \ + --hash=sha256:2e31c4e68cffd7b1f116127626813b82fcba19edf6b940a7b0c266d6484d0055 \ + --hash=sha256:34fb3db1149c879343861831728c243c432d4a5afc8f1878ca7612ef8de2a033 \ + --hash=sha256:37290fbef0c73e2d51d594eb78fded7dc7170d1c3ad0a890269e6fd8c8c4e061 \ + --hash=sha256:405be6058e206a86fedce2f715ecc2343f94072d7925251632dffa2c05f70dca \ + --hash=sha256:40a266371ece581e5de13b6635ef78d7487824af80561b6ca27694a88c19bc0f \ + --hash=sha256:42d63be3af4f9b951b199b0a9d23365d37ab14687e6d77b74940432c8515c4ca \ + --hash=sha256:44629d4498c9cb6b2051806155f22141df0d8a929c56134b166655232dfb2f8c \ + --hash=sha256:49c12af515073e9bf511e4ef736743bf70d531a643668722279314b937742ba4 \ + --hash=sha256:4a25756244bdcce3b50580baadf320fa48297f0eeb8e114ba64139a40d4d0fc8 \ + --hash=sha256:4bd024d567eca931b668978d672dba914d4b8e2628e2c3073a2ad178de8a2620 \ + --hash=sha256:4f8db54177035a2b5f717f94475b74907e12a96dc74f6d487f3966b0a4694071 \ + --hash=sha256:51ebb529fc5e8abdd55302f6c3f8943037348ec2384329a3e55677f69ae2fdfc \ + --hash=sha256:567f20f1c75897d7663830da6ea8af719e03d712b1d9ee7f813319f9ece42e5a \ + --hash=sha256:5933fcea5a5ba64c686f55c886a115cbfd92f2900460784a1e79909fdbafd7b6 \ + --hash=sha256:5bdb38ba220b61b4ec31dd1046dea6b016d3c6850a23f43ed8b58332b2fc668e \ + --hash=sha256:5f56499c1a74d2b862beb0c33b8016f99d095858455df9d21583bbbc1c15b582 \ + --hash=sha256:67871a13cf47275201553b536c025da777f997fa562a19eb798af4ad4b97c18f \ + --hash=sha256:67c8d44ad89fa7eb88de5d6ef6199b1e03dd24974f85a67639fc8badb801fe79 \ + --hash=sha256:6a0920cb55df5a4d3f6862964908078c0bd59332bdd1bcd20d14e8c70ef27cc5 \ + --hash=sha256:6bce6a29c3898191f4c9998e4d4e8f69790caeabde46e54da4bc235ce5bde683 \ + --hash=sha256:6f38f3f885a09cafc93fd667b1173a92f379e43785d635e7983c893f0da319fb \ + --hash=sha256:73ee25cf8cf8b75d5a5aeed7cb6588f5e5dbfbb0fde51707b630bbb23897645c \ + --hash=sha256:7b999816b5850a35ada08443e6e03945f1f6488144a83afe2d37b240a552aafa \ + --hash=sha256:7c88c10dd432f3b39ccdafc9ed81d0c21b8fd634502574da76d1bfa4fe2c76d0 \ + --hash=sha256:7d5e097eabd5d4915c27ac9f6e9325bb1e01a7c94d7348b5c4451d3fc30e8521 \ + --hash=sha256:7e91e97a929232cdb828889ee6ad0e48d7f40f4ec38818f4e4a8968b2b1af22e \ + --hash=sha256:7f6299e494e46253d40c34653cac369412f44ca53b5f85d848d3f95b1ed0546c \ + --hash=sha256:816752a5ef76a80484c8c441c85593b7ea9304f6231fc5776ad1fbff7e773058 \ + --hash=sha256:83b37abd87b590acd8f47ca8a61f70893322b11834d36e07c2298dacad4d14d2 \ + --hash=sha256:8619685cad8efc4c38c66d3b36aad854523297c43d748b3b6f0cc03c90ba3463 \ + --hash=sha256:8bf295fe459343bc6093c8e5e0df60bfa189e0fcb775a22e2c2488fdeccc6c0d \ + --hash=sha256:8e459b613cf31f8980f584387b4fe47bf08e076e288d61aa8eba1f7fd4ddbb81 \ + --hash=sha256:8f36aa77f74b14a2103622b196402c71330e4e7cf4122ee45c854e9a01e0eecf \ + --hash=sha256:93ff9c9c3663ce23aaa5d0b6b6abac55359e2a0c06c7e30f3771829af816be63 \ + --hash=sha256:9a635068d9793c7f0d929f39f18b58f1bd86c236e8e7b64167b86af9232ebca0 \ + --hash=sha256:9dda0788a9932776a75d8bcc020076edc308ce2508b51f6739a45e3158b3fc42 \ + --hash=sha256:a192360d512305fe92d3053e4f7627bbad1f7708f1f4ad38cccd9336acabe9ad \ + --hash=sha256:a2a14cd73d5e6c927f644b0110ee81f59c4ef506259ec9183904747f2caacc81 \ + --hash=sha256:a625df9a2a5597fa5e5266e01aefc82604bb85d291e3547981e863560d75da6c \ + --hash=sha256:a6aaa7871aebca081eb5c45f83e845bbd9712ae99fa9286dbfdcee835e63f4b4 \ + --hash=sha256:aa694c49787040943570d61c9b8fc01271bd2a2cfdd55f0d896f8aecdce1a981 \ + --hash=sha256:adb3c2124c68e480f4632d06cb7caa3b48a51678475f483b4edb1c6dee29ea43 \ + --hash=sha256:b84be41387fc00db28c13c02e30d42b02d8d8f6a4a741a1aee6012ca7f1f6039 \ + --hash=sha256:bf97ba1b5542050e9b0c74e632323b6d8136cc99d64e193abebee22fe6013c76 \ + --hash=sha256:c3bc8ee0271387e0b1e3ad0ff893645990a656e79bf9c42f4f734a3642b11d51 \ + --hash=sha256:c50c80e3591e5cf9a8dfa6007d4f10732f02e32263850999286e56ccd650cfb2 \ + --hash=sha256:c6fd031333dedcad7ce3e03d244093f43504f209e86925ebdb2b868fa4037630 \ + --hash=sha256:c87a04e7f152ee4db5dbe15f0bfa3fe628a1aeedbe66b81c43b87f52c813f9ac \ + --hash=sha256:cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510 \ + --hash=sha256:d4737f50d23ddd11d6685faacbb9252887dde0bc7997127757247983d74399d6 \ + --hash=sha256:d7710eb676e9bb68965cb045be0d333b4c0d7f9dfbaa7fbf121385b1588683d3 \ + --hash=sha256:d9b0a2bee3f3e03e9f29057aedb807dbf1e1d96ee1b9d0f422d9db6c8583271d \ + --hash=sha256:e65dd6e75de67b2362a4fa3e16aa627595f65054dc4ec73d64680c84d592fa61 \ + --hash=sha256:e892354a424b1e82a78ba16785822bdd40de06f19446a3d4a28047df1a4f8932 \ + --hash=sha256:e8ca8f69b7c77fa96dad99f8638c1fc4f1c0bed4acaa1baf7a3c31bdb80a0ab1 \ + --hash=sha256:e91c2b1cbeae768c98752e67e717e283d68dae45717b41f2d91eaee648e37b7d \ + --hash=sha256:e98b4f91f99b24b1da72e10621ba181f7281922384a7403094debb4199de6c00 \ + --hash=sha256:ef5fe6b7db3f501c56000ba8fe7c7e1a35ca1d45824fbeb95a67daa85cff4dbe \ + --hash=sha256:f11a3c1358bb3c68012a7b1f41b223c3db9f7bfde90b481df028cfe1c3363313 \ + --hash=sha256:f391dc92a015c478745192fe4f2e120c2af2aba18d9fe0616341cbf537599806 \ + --hash=sha256:f7cbb7a64e7ec664775195e4f81923bc8a93d9451b963f844e59118f63147a7a \ + --hash=sha256:f9bd7d260d986f3553518c5d723544346fa48031f8aef3265d786aeb59845bc0 \ + --hash=sha256:fc481f742ccda20e9ed760b8f978dff50f2a4e9bc253ac167fb0a05b0783ef52 \ + --hash=sha256:ff3fe9eb621fbb9db4c4be33ab946f6bac5f98ab50ca8d3260503653656c961b \ + --hash=sha256:ffea6b2986a797c84b6d1d27d4f43e0b83c73fc16281a930891cd237cf0d08fe # via # -r requirements.txt # pytesseract @@ -875,9 +873,9 @@ pymupdf==1.25.5 \ --hash=sha256:d94b800e9501929c42283d39bc241001dd87fdeea297b5cb40d5b5714534452f \ --hash=sha256:ee22155d3a634642d76553204867d862ae1bdd9f7cf70c0797d8127ebee6bed5 # via -r requirements.txt -pypdf==6.16.2 \ - --hash=sha256:595647f6191de6f402cfde1d0c455d6cbccbd509aac32b34783009c032de5d6e \ - --hash=sha256:c8b09a59399062fb45a1b8156c18a787a10a3dae03ac9674397a226712c94604 +pypdf==6.21.2 \ + --hash=sha256:0a3e1c5c886a1be03646c16a04827cc166c2a0575c971b26a4bf89686551c2d4 \ + --hash=sha256:1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084 # via -r requirements.txt pytesseract==0.3.13 \ --hash=sha256:4bf5f880c99406f52a3cfc2633e42d9dc67615e69d8a509d74867d3baddb5db9 \ @@ -1114,10 +1112,12 @@ safetensors==0.8.0 \ --hash=sha256:fcdd41ec4628fee5799f807c73c353629130fbd942aa23d83c623dd6c9d52d78 \ --hash=sha256:fd6f3f93c9a0a7cc2788ee63fb763353d4bd2e89b0751bc78fcf7dda00bea774 # via transformers -setuptools==84.0.0 \ - --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \ - --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73 - # via torch +setuptools==84.1.0 \ + --hash=sha256:23657205b63d4d31395ab917815247f694aafad28cd21316bf5fd45a51048ea0 \ + --hash=sha256:5231689c6ac8156cd155cfb98c3fd6fb252c3e7e9bd3d78b64d3c55f132624c9 + # via + # -r requirements.txt + # torch starlette==1.6.0 \ --hash=sha256:a86dd39d14bb45f85a3d18525215a9ef0cfd1f192ac793220e72598c90335f0c \ --hash=sha256:d4e3ac5e546444960c710297a3c9fc3f7ebae1b7e963f3d36173b49da535be9b @@ -1191,10 +1191,12 @@ typing-inspection==0.4.4 \ --hash=sha256:547274fa6b0a561ccf549cc9524b999a578e737d015d8709d021f9d0d13bea47 \ --hash=sha256:65b8397ba37ccbce054456aaccddfc91e6e3083c92824df348d96ca832f3f147 # via fastapi -urllib3==2.7.0 \ - --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \ - --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897 - # via requests +urllib3==2.8.0 \ + --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \ + --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63 + # via + # -r requirements.txt + # requests uvicorn==0.34.0 \ --hash=sha256:023dc038422502fa28a09c7a30bf2b6991512da7dcdb8fd35fe57cfc154126f4 \ --hash=sha256:404051050cd7e905de2c9a7e61790943440b3416f49cb409f965d9dcd0fa73e9 diff --git a/tools/summarizer/requirements.txt b/tools/summarizer/requirements.txt index 1a38891..eb05dcd 100644 --- a/tools/summarizer/requirements.txt +++ b/tools/summarizer/requirements.txt @@ -5,9 +5,13 @@ transformers==4.48.3 cachetools==5.5.2 pydantic==2.10.6 torch==2.6.0 -pillow==12.3.0 +pillow==13.0.0 pytesseract==0.3.13 -pypdf==6.16.2 +pypdf==6.21.2 pymupdf==1.25.5 python-docx==1.1.2 python-multipart==0.0.32 +# Constrain transitive TLS/build dependencies to reviewed security fixes. +certifi==2026.10.19 +urllib3==2.8.0 +setuptools==84.1.0 diff --git a/tools/summarizer/tests/test_parser_security.py b/tools/summarizer/tests/test_parser_security.py new file mode 100644 index 0000000..ffd5386 --- /dev/null +++ b/tools/summarizer/tests/test_parser_security.py @@ -0,0 +1,57 @@ +"""Bounded regressions for upload-parser advisories, without hostile large allocations.""" + +import io +import struct +import subprocess +import sys +import zlib + +import pytest +from PIL import Image + + +def test_truncated_pdf_xref_finishes_without_exhausting_parser_timeout(): + # GHSA-39mj-jf6j-2qj3: an incomplete xref's final short line must not spin. + script = """ +import io +from pypdf import PdfReader +from pypdf.errors import PdfReadError +body = b'%PDF-1.0\\n 1 0 obj<>endobj\\n 2 0 obj<>endobj\\n' +tail = b'\\n startxref\\n%d\\n%%%%EOF' % len(body) +try: + PdfReader(io.BytesIO(body + b'xref\\n 0 3\\n 0000000000 65535 f \\n' + tail)) +except PdfReadError: + print('rejected') +else: + raise AssertionError('Incomplete xref was accepted') +""" + result = subprocess.run([sys.executable, "-c", script], capture_output=True, text=True, timeout=5) + assert result.returncode == 0, result.stderr + assert result.stdout.strip() == "rejected" + + +def test_apng_rejects_oversized_canvas_before_background_allocation(monkeypatch): + # GHSA-5xm2-6676-qcp9, scaled to64 pixels so the RED case stays harmless. + def chunk(kind, data): + return struct.pack(">I", len(data)) + kind + data + struct.pack(">I", zlib.crc32(kind + data)) + + png = ( + b"\x89PNG\r\n\x1a\n" + + chunk(b"IHDR", struct.pack(">IIBBBBB", 8, 8, 8, 6, 0, 0, 0)) + + chunk(b"acTL", struct.pack(">II", 2, 0)) + + chunk(b"fcTL", struct.pack(">IIIIIHHBB", 0, 1, 1, 0, 0, 1, 10, 1, 0)) + + chunk(b"IDAT", zlib.compress(b"\x00\x00\x00\x00\x00")) + + chunk(b"IEND", b"") + ) + monkeypatch.setattr(Image, "MAX_IMAGE_PIXELS", 16) + fills = [] + original_fill = Image.core.fill + + def record_fill(mode, size, *args): + fills.append(size) + return original_fill(mode, size, *args) + + monkeypatch.setattr(Image.core, "fill", record_fill) + with pytest.raises(Image.DecompressionBombError): + Image.open(io.BytesIO(png)) + assert (8, 8) not in fills, "An oversized canvas was allocated before bomb rejection"