From 22ef8d003c8afcab7b901060a224e1434a7a761c Mon Sep 17 00:00:00 2001 From: cesnimda Date: Sun, 25 Oct 2026 07:40:52 +0100 Subject: [PATCH] fix: pin model revisions and quarantine MariaDB CI routing --- .gitea/workflows/mariadb-integration.yml | 7 +- .../phase-9/p9-sec-02/ADVISORY_RESEARCH.md | 81 + .../phase-9/p9-sec-02/CI_ASSESSMENT.md | 59 + .../redesign/phase-9/p9-sec-02/MODEL_CACHE.md | 23 + docs/redesign/phase-9/p9-sec-02/PLAN.md | 16 + docs/redesign/phase-9/p9-sec-02/PROGRESS.md | 15 + .../phase-9/p9-sec-02/advisory-research.json | 21079 ++++++++++++++++ .../phase-9/p9-sec-02/ci-assessment.json | 344 + .../phase-9/p9-sec-02/model/ARTIFACTS.json | 164 + .../redesign/phase-9/p9-sec-02/model/probe.py | 49 + .../phase-9/p9-sec-02/model/test_verify.py | 40 + .../phase-9/p9-sec-02/model/verify.py | 21 + scripts/test-mariadb-workflow.py | 34 + tools/summarizer/app.py | 6 +- tools/summarizer/tests/test_app.py | 31 + 15 files changed, 21964 insertions(+), 5 deletions(-) create mode 100644 docs/redesign/phase-9/p9-sec-02/ADVISORY_RESEARCH.md create mode 100644 docs/redesign/phase-9/p9-sec-02/CI_ASSESSMENT.md create mode 100644 docs/redesign/phase-9/p9-sec-02/MODEL_CACHE.md create mode 100644 docs/redesign/phase-9/p9-sec-02/PLAN.md create mode 100644 docs/redesign/phase-9/p9-sec-02/PROGRESS.md create mode 100644 docs/redesign/phase-9/p9-sec-02/advisory-research.json create mode 100644 docs/redesign/phase-9/p9-sec-02/ci-assessment.json create mode 100644 docs/redesign/phase-9/p9-sec-02/model/ARTIFACTS.json create mode 100644 docs/redesign/phase-9/p9-sec-02/model/probe.py create mode 100644 docs/redesign/phase-9/p9-sec-02/model/test_verify.py create mode 100644 docs/redesign/phase-9/p9-sec-02/model/verify.py create mode 100644 scripts/test-mariadb-workflow.py diff --git a/.gitea/workflows/mariadb-integration.yml b/.gitea/workflows/mariadb-integration.yml index 9f259c7..5478e4b 100644 --- a/.gitea/workflows/mariadb-integration.yml +++ b/.gitea/workflows/mariadb-integration.yml @@ -1,12 +1,13 @@ name: MariaDB persistence qualification on: push: - branches: [codex/rd21-mariadb-standardisation, fix/p9-ci-and-requalification] - pull_request: + branches: [codex/rd21-mariadb-standardisation, fix/p9-ci-and-requalification, fix/p9-model-cache-and-ci-qualification] + # Restore PR preparation only after the dedicated runner/trust-boundary review. workflow_dispatch: jobs: mariadb: - runs-on: ubuntu-latest + # This unique label must be registered on an isolated nonproduction runner. + runs-on: jobtracker-mariadb-isolated steps: - name: Require verified runner isolation # Remove this blocker only after the operator evidence and workflow review in the handoff. diff --git a/docs/redesign/phase-9/p9-sec-02/ADVISORY_RESEARCH.md b/docs/redesign/phase-9/p9-sec-02/ADVISORY_RESEARCH.md new file mode 100644 index 0000000..c1a9123 --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/ADVISORY_RESEARCH.md @@ -0,0 +1,81 @@ +# P9-SEC-02 advisory research + +Read-only source assessment; **no runtime compatibility or production acceptance claimed**. All44 remaining groups are assessed individually in [advisory-research.json](advisory-research.json). The JSON retains original alias IDs, affected ranges, fixed events, severity/vector, refreshed primary evidence, installed paths/hashes, input reachability, mitigation/residual, compatibility risks and required tests. Root qualification owns final dispositions. + +## Accounting + +109 original alias groups =65 previously removed +44 researched here (filelock3, torch19, Transformers22). The earlier249→99 provider-record counts are retained and are not distinct vulnerability counts. This lane adds zero runtime/model qualification passes. No owner acceptance. + +## Minimal candidate graph and compatibility gates + +- filelock4.2.1 addresses all three published filelock ranges. Qualify native and soft fallback lock ownership, contention/stale markers and finite timeouts on Windows and Linux; shared writable cache permissions are not established here. +- torch2.13.0+cpu is the smallest published all-fixable-record bound because JIT CVE-2025-3000 remains affected through2.12.1. The vendor CPU index advertises cp312 Windows amd64 and manylinux_2_28 x86_64 wheels. Use those CPU identities, not the PyPI generic Linux wheel that requires CUDA13. Actual wheel/import/inference qualification is pending. +- Transformers5.10.0 is the latest first-patched bound among these records (chat-template save traversal). Its base metadata requires huggingface-hub>=1.5,<2, tokenizers>=0.22,<=0.23, regex>=2025.10.22 and typer; current installed hub0.36.2/tokenizers0.21.4 cannot stay pinned. Resolve/hash the graph in isolation and preserve the65 prior remediations. Tagged5.10 source still has AutoModelForSeq2SeqLM and BART mapping; that is not import/inference proof. +- These versions do not establish closure of all44: eight ZDI conversion/deserialization groups and torch.pt2 have no verified release fix. CVE-2025-55554 has a still-open vendor issue despite a provider2.9 fix event. Never claim a fully safe graph from maximum version arithmetic alone. + +Candidate metadata: [filelock](https://pypi.org/pypi/filelock/4.2.1/json), [torch](https://pypi.org/pypi/torch/2.13.0/json), [Transformers](https://pypi.org/pypi/transformers/5.10.0/json), [vendor CPU index](https://download.pytorch.org/whl/cpu/torch/).98 distinct source responses retained: first54-request vendor/security batch succeeded, then all44 OSV refreshes succeeded.12 repeated GitHub API requests hit rate limits; initial successful raw bodies remain, with captured-file mtime explicitly distinguished from HTTP retrieval timestamps. Exact URLs, hashes and repeat errors are in `.artifacts/p9-sec-02/advisory-research/refresh-index.json`. + +## Actual service path and limits + +`app.py:161` loads fixed-name AutoTokenizer/AutoModelForSeq2SeqLM, calls eval, then tokenizer truncation1024 → no_grad → generate with3 beams → decode. Installed Auto mappings select BartTokenizer/Fast and BartForConditionalGeneration for a BART config. BART layers are attention/linear/norm; dropout exists but eval disables training dropout. This differs from LSTM, CTC, image pooling, sparse graphs, JIT/Inductor, TensorFlow optimizers and conversion CLIs. The parser child handles uploads via pypdf/Pillow/Tesseract, not Donut/Transformers video/CTC. + +The actual serialized config/checkpoint remains a separate trust boundary: no immutable model revision or manifest is supplied by app.py; safetensors is not required. Installed Transformers load_state_dict493 reaches torch.load535 for non-safetensors files with weights_only=True. That flag does not protect torch2.6 from CVE-2026-24747. Do not dismiss loader risk just because app.py lacks a direct torch.load call. Fixed model name is not artifact integrity. + +Installed source fingerprints are preserved in `installed-source-matches.json`; no Python model modules were imported. Windows METADATA reports torch2.6.0 rather than locked2.6.0+cpu. Installed model tree has no conversion scripts and no LightGlue implementation; these facts qualify specific paths and do not clear the entire package. Current4.48.3 attention selection rejects arbitrary repository strings; CVE-2026-4372 still needs an introduction/fix or safe negative regression before a definitive exemption. + +## Individual alias groups + +Disposition is scoped to the current inspected service, and does not silently remove matching package records. “Fix available but blocked by compatibility” means qualification is pending, not that a failed compatibility test occurred. Published severities remain unchanged. + +| Group / all aliases | Vulnerable function and installed locator | Range → patch | Service reachability and residual | Disposition | +| --- | --- | --- | --- | --- | +| [CVE-2026-112940](https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8)
GHSA-v4x8-3wr5-3wq8 | ReadWriteLock SQLite database reopen and POSIX symlink/side-file handling
`tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py` | >= 3.20.4, <= 4.2.0 → 4.2.1 | SQLite-backed ReadWriteLock is a different lock type from Hub WeakFileLock; installed Hub _fixes.py constructs FileLock then SoftFileLock. Remote document text cannot choose lock type or database filename. No ReadWriteLock application import/call. Scoped service lock selection excludes this SQLite API; package remains in affected range. Reassess if reader/writer locks are introduced. | Not affected with evidence | +| [CVE-2026-112913](https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5)
GHSA-9vhv-jxww-xfm5 | ReadWriteLock Windows SQLite -wal/-journal/-shm handling
`tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py` | >= 3.20.4, <= 4.2.0 → 4.2.1 | Requires local attacker-created SQLite side files in shared writable directory. Current cache helper uses native FileLock or SoftFileLock, not SQLite ReadWriteLock; parser has no filelock import. Service call graph excludes ReadWriteLock, not all uses of filelock. Cache directory permissions are not claimed verified. | Not affected with evidence | +| [CVE-2026-112907](https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92)
GHSA-567q-5qvw-pf92 | SoftFileLock marker open/stale breaking on Windows oplock
`tools/summarizer/.venv/Lib/site-packages/filelock/_soft.py` | >= 3.22.0, <= 4.2.0 → 4.2.1 | Hub WeakFileLock fallback reaches SoftFileLock; filelock native lock can also fall back. Local user able to open cache marker can stall open beyond timeout. Cannot dismiss using HTTP request limits or parser child timeout. Upgrade filelock4.2.1; qualify native/fallback lock contention, stale marker and finite timeout on Windows and Linux. Existing source checks do not prove ACL isolation. | Fix available but blocked by compatibility | +| [CVE-2025-3001](https://github.com/advisories/GHSA-qfhq-4f3w-5fph)
BIT-pytorch-2025-3001, GHSA-qfhq-4f3w-5fph, PYSEC-2025-195 | torch.lstm_cell / native LSTM cell tensor validation
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/rnn.py` | < 2.10.0 → 2.10.0 | Installed LSTMCell forwards to _VF.lstm_cell. BART decoder uses attention, linear and layer norms, not recurrent LSTMCell. Request text becomes bounded token IDs, not arbitrary tensor dimensions or Python graphs. BART architecture excludes LSTM operation; native wheel and future architectures remain vulnerable until patched. | Mitigated with residual risk | +| [CVE-2025-3000](https://github.com/advisories/GHSA-rrmf-rvhw-rf47)
BIT-pytorch-2025-3000, GHSA-rrmf-rvhw-rf47, PYSEC-2025-194 | torch.jit.script compilation
`tools/summarizer/.venv/Lib/site-packages/torch/jit/_script.py` | <= 2.12.1 → 2.13.0 | Application does not call script or torch.compile; model loader creates Python BART class and generate uses eager no_grad. Text cannot submit Python source or choose a compiled graph. Third-party optional branches/native internals are not runtime qualified. 2.13.0 is current published first patch; synthetic eager tests alone cannot prove selected checkpoint inference compatibility. | Fix available but blocked by compatibility | +| [CVE-2025-2999](https://github.com/advisories/GHSA-vgrw-7cvw-pwgx)
BIT-pytorch-2025-2999, GHSA-vgrw-7cvw-pwgx, PYSEC-2025-193 | torch.nn.utils.rnn.unpack_sequence
`tools/summarizer/.venv/Lib/site-packages/torch/nn/utils/rnn.py` | < 2.9.1 → 2.9.1 | BART accepts padded input_ids plus attention_mask and does not construct PackedSequence or unpack_sequence; malicious tensor metadata is not an HTTP input. Different RNN API; retain affected-package finding until patched or scoped owner decision. | Mitigated with residual risk | +| [CVE-2025-2953](https://github.com/advisories/GHSA-3749-ghw9-m3mg)
BIT-pytorch-2025-2953, GHSA-3749-ghw9-m3mg, PYSEC-2025-191 | torch.mkldnn_max_pool2d
`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | < 2.7.1-rc1 → 2.7.1-rc1 | Vendor names mkldnn_max_pool2d. BART attention/linear architecture contains no image/max-pooling layer. Raw image bytes go to separate OCR parser; they are not passed as model tensor graphs. No selected BART max-pooling path identified; local arbitrary Python remains outside HTTP boundary. | Mitigated with residual risk | +| [CVE-2025-46148](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46148, PYSEC-2025-198 | nn.PairwiseDistance(p=2), eager/Inductor inconsistent result
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/distance.py` | Prior provider events → 2.7.0; exact ranges in JSON | Installed PairwiseDistance wrapper exists; BART/generate path does not compute pairwise distances. Vendor issue describes numeric correctness, not a demonstrated remotely supplied model graph. Architectural separation reduces service exposure; provider range and severity retained without claiming native safety. | Mitigated with residual risk | +| [CVE-2025-46149](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46149, PYSEC-2025-199 | nn.Fold Inductor code generation assertion
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/fold.py` | Prior provider events → 2.7.0; exact ranges in JSON | Fold constructs image blocks; BART text inference has no Fold and does not call torch.compile or Inductor. Requires a different operation and compiler route; preserve scanner finding until package patch. | Mitigated with residual risk | +| [CVE-2025-46150](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46150, PYSEC-2025-200 | FractionalMaxPool2d torch.compile correctness
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/pooling.py` | Prior provider events → 2.7.0; exact ranges in JSON | No FractionalMaxPool2d in selected BART layers; application performs eager eval generation without compilation. Model graph cannot be supplied through text; unqualified optional/native branches remain residual. | Mitigated with residual risk | +| [CVE-2025-46152](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46152, PYSEC-2025-201 | bitwise_right_shift boundary shift in Inductor
`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/codegen/cpp.py` | Prior provider events → 2.7.0; exact ranges in JSON | Vendor issue concerns compiled out-of-range shift count. Application accepts text, no arbitrary shift operand/compiler graph; selected BART layer source has no bitwise_right_shift. Eager BART separation; not a claim that every installed tensor operation is fixed. | Mitigated with residual risk | +| [CVE-2025-46153](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46153, PYSEC-2025-202 | bernoulli_p decomposition, fallback_random, Dropout1d/2d/3d
`tools/summarizer/.venv/Lib/site-packages/torch/_decomp/decompositions.py` | Prior provider events → 2.7.0; exact ranges in JSON | BART contains functional.dropout, so merely saying no dropout would be false. model.eval() disables training dropout; app does not enable Inductor fallback_random nor spatial Dropout1d/2d/3d. Vendor source points to Inductor fallback; old summary says before3.7.0 while range fixes2.7.0. Preserve discrepancy and use exact provider events, not guessed3.7 pin. | Mitigated with residual risk | +| [CVE-2025-55551](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55551, PYSEC-2025-203 | torch.linalg.lu with slicing in Inductor/AOT
`tools/summarizer/.venv/Lib/site-packages/torch/linalg/__init__.py` | Prior provider events → 2.9.0; exact ranges in JSON | Vendor issue contrasts compiled/AOT and eager LU slicing. BART attention does not perform LU decomposition and application has no compile/AOT route. Published range includes2.6 though issue title mentions2.8; no suppression solely from version in prose. | Mitigated with residual risk | +| [CVE-2025-55552](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55552, PYSEC-2025-204 | torch.rot90 and randn_like compiled graph
`tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py` | Prior provider events → 2.9.0; exact ranges in JSON | BART does not rotate image tensors or compile rot90/randn_like graphs. Text token IDs cannot select these APIs. Vendor issue is compiler/eager mismatch; package severity remains source-reported. | Mitigated with residual risk | +| [CVE-2025-55553](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55553, PYSEC-2025-205 | proxy_tensor.py tracing .random_ syntax error
`tools/summarizer/.venv/Lib/site-packages/torch/fx/experimental/proxy_tensor.py` | Prior provider events → 2.7.1; exact ranges in JSON | Proxy tensor tracing/compiler route, not ordinary BART no_grad eager generation. Application exposes no graph tracing or caller-defined modules. No compiled tracing request boundary identified; changing execution mode needs new review. | Mitigated with residual risk | +| [CVE-2025-55554](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55554, PYSEC-2025-206 | torch.nan_to_num then long edge-case numeric conversion
`tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py` | Prior provider events → 2.9.0; exact ranges in JSON | Selected BART source has no nan_to_num().long() chain. Vendor issue remains open despite provider2.9.0 fix event; report does not infer closed/resolved from version metadata. Provider patch claim conflicts with still-open vendor issue. Need fix-commit/reproducer confirmation before Fixed verified. | Unresolved | +| [CVE-2025-55557](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55557, PYSEC-2025-207 | Inductor compiled cummin Triton NameError
`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py` | Prior provider events → 2.7.1; exact ranges in JSON | Selected BART attention and beam generation do not call compiled cummin; eager app supplies token text and uses CPU baseline rather than authored Triton kernels. Architectural reduction only; CPU and CUDA selection still require candidate qualification. | Mitigated with residual risk | +| [CVE-2025-55558](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55558, PYSEC-2025-208 | Inductor Conv2d/hardshrink/view/mv compiler failure
`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | Prior provider events → 2.7.1; exact ranges in JSON | Vendor issue reports CppCompileError while scanner summary calls buffer overflow. BART is text attention/linear model, lacks this Conv2d/hardshrink chain, and app does not compile. Retain source disagreement; no security downgrade justified merely by compiler error title. | Mitigated with residual risk | +| [CVE-2025-55560](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55560, PYSEC-2025-209 | Inductor to_sparse/to_dense lowering
`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py` | Prior provider events → 2.7.1; exact ranges in JSON | BART does not create sparse model inputs and app does not enable Inductor. Sparse tensor graph cannot be submitted through summarize text. Package remains affected according to provider; graph separation is a mitigation, not patch proof. | Mitigated with residual risk | +| [CVE-2026-4538](https://github.com/pytorch/pytorch/)
BIT-pytorch-2026-4538, PYSEC-2026-139 | torch.export.load .pt2 deserialization
`tools/summarizer/.venv/Lib/site-packages/torch/export/__init__.py` | Prior provider events → no published fix; exact ranges in JSON | Installed export.load API exists but Transformers load_state_dict uses safetensors or torch.load, not export.load. Neither app nor parser accepts .pt2 or model uploads. Fixed repository alone does not establish checkpoint integrity. No published fixed release in baseline ranges. Vendor PR176791 closed without merged_at; proposal requires explicit weights_only=True and cannot establish released patch. No export.load in service path. | No fix | +| [CVE-2025-3730](https://github.com/advisories/GHSA-887c-mr87-cxwp)
BIT-pytorch-2025-3730, GHSA-887c-mr87-cxwp, PYSEC-2026-1970 | torch.nn.functional.ctc_loss / native LossCTC
`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | <= 2.7.1 → 2.8.0 | Vendor identifies CTC loss; service invokes BARTForConditionalGeneration.generate without labels, training or CTC. OCR uses Tesseract in parser child, not torch CTC. Specific alternate loss API, not generic model-resource bug. No inference/native compatibility PASS asserted. | Mitigated with residual risk | +| [CVE-2026-24747](https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p)
BIT-pytorch-2026-24747, GHSA-63cw-57p8-fm3p, PYSEC-2026-1856, PYSEC-2026-2286 | torch.load(weights_only=True) unpickler memory corruption
`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py` | < 2.10.0 → 2.10.0 | Actual installed load_state_dict493 forwards non-safetensors checkpoints to torch.load535 with weights_only=True. app.from_pretrained does not require safetensors or pin revision; therefore malicious or compromised model/cache checkpoint can reach vulnerable loader even though no direct app torch.load exists. Upgrade torch>=2.10 minimum for this issue; full published graph needs2.13.0. Require immutable revision, actual artifact format/hashes and benign inference. weights_only=True is not sufficient mitigation on2.6. | Fix available but blocked by compatibility | +| [CVE-2025-14929](https://osv.dev/vulnerability/PYSEC-2025-217)
PYSEC-2025-217 | X-CLIP checkpoint conversion unsafe deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/x_clip/convert_x_clip_original_pytorch_to_hf.py` | Prior provider events → no published fix; exact ranges in JSON | Installed wheel contains no *convert* files under transformers/models. BART auto model selection does not run X-CLIP conversion CLI; service accepts no checkpoint conversion arguments. Refreshed ZDI1144 still provides restriction mitigation, no patched version. Absent conversion script and fixed service route reduce exposure; no all-version package exemption. | No fix | +| [CVE-2025-2099](https://github.com/advisories/GHSA-qq3j-4f4f-9583)
GHSA-qq3j-4f4f-9583, PYSEC-2025-40 | testing_utils.preprocess_string doctest ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/testing_utils.py` | < 4.50.0 → 4.50.0 | Installed2593 preprocess_string processes Python/Markdown doctest contents. App tokenizer does not use testing_utils; CV text/Markdown uploads go through parser normalization, not doctest preparation. Different function/input ownership; use4.50.0 current GHSA first patch rather than ambiguous prior4.49 event. | Not affected with evidence | +| [CVE-2025-14926](https://osv.dev/vulnerability/PYSEC-2025-214)
PYSEC-2025-214 | SEW conversion convert_config string eval
`tools/summarizer/.venv/Lib/site-packages/transformers/models/sew/convert_sew_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | Conversion script is absent from installed models tree; BART inference has no SEW conversion or checkpoint argument input. ZDI1147 refreshed report remains0-day with no release patch. Do not add conversion capability; arbitrary model files remain untrusted. | No fix | +| [CVE-2025-14930](https://osv.dev/vulnerability/PYSEC-2025-218)
PYSEC-2025-218 | GLM4 weights parsing unsafe deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/glm4` | Prior provider events → no published fix; exact ranges in JSON | No glm4 directory in installed4.48.3; selected mapping is BART, not GLM4. Advisory version range broader than named architecture availability; no assumption newest release fixes this. ZDI1145 still has no fixed version. Keep identity check for actual config; upgrading can introduce new architecture code. | No fix | +| [CVE-2025-14920](https://osv.dev/vulnerability/PYSEC-2025-211)
PYSEC-2025-211 | Perceiver model conversion/deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/perceiver` | Prior provider events → no published fix; exact ranges in JSON | Perceiver model package exists but no conversion scripts are installed. AutoModelForSeq2SeqLM maps bart to BartForConditionalGeneration; Perceiver has distinct model/configuration and tokenizer modules. No model upload endpoint. ZDI1150 no fix; actual Perceiver entry-point identity not published by ZDI beyond parsing. Treat family restriction as scoped mitigation rather than proven whole-package absence. | No fix | +| [CVE-2025-14921](https://osv.dev/vulnerability/PYSEC-2025-212)
PYSEC-2025-212 | Transformer-XL tokenizer/model pickle deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py` | Prior provider events → no published fix; exact ranges in JSON | Installed TransfoXL tokenizer explicitly contains pickle.load and warns/deprecates unsafe loading. BartTokenizer/BartTokenizerFast map uses JSON vocab/merges and byte BPE; no Transformer-XL vocab accepted by service. ZDI1149 no fixed release; dangerous API does exist. Architecture selection and no vocab upload reduce reachability; trust actual config identity before stronger verdict. | No fix | +| [CVE-2025-14924](https://osv.dev/vulnerability/PYSEC-2025-213)
PYSEC-2025-213 | megatron_gpt2 checkpoint conversion deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/megatron_gpt2/convert_megatron_gpt2_checkpoint.py` | Prior provider events → no published fix; exact ranges in JSON | Conversion scripts absent in installed models tree; selected BART loader uses standard load_state_dict, not Megatron conversion. General torch.load checkpoint risk tracked separately under24747. ZDI1141 says vendor declined changes; no patched version. Do not treat newer Transformers as closing this record without evidence. | No fix | +| [CVE-2025-14927](https://osv.dev/vulnerability/PYSEC-2025-215)
PYSEC-2025-215 | SEW-D convert_config eval
`tools/summarizer/.venv/Lib/site-packages/transformers/models/sew_d/convert_sew_d_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | SEW-D conversion source absent from installed wheel. HTTP summarize does not expose conversion/config strings or select audio model families. ZDI1148 no fix; fixed model family is mitigation, not universal library safety. | No fix | +| [CVE-2025-14928](https://osv.dev/vulnerability/PYSEC-2025-216)
PYSEC-2025-216 | HuBERT convert_config eval
`tools/summarizer/.venv/Lib/site-packages/transformers/models/hubert/convert_hubert_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | HuBERT conversion source absent from installed wheel; BART tokenizer/model path does not invoke audio conversion. ZDI1146 no release patch. Retain record rather than infer upgrade clears it. | No fix | +| [CVE-2025-3933](https://github.com/advisories/GHSA-37mw-44qp-f5jm)
GHSA-37mw-44qp-f5jm, PYSEC-2026-1977 | DonutProcessor.token2json ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/donut/processing_donut.py` | <= 4.51.3 → 4.52.1 | Actual Donut token2json regex exists in separate processor. Service document OCR invokes Tesseract/Pillow, never DonutProcessor; BART decode returns text without token2json. Explicit different document-processing owner avoids confusing OCR with Donut; installed affected API remains. | Mitigated with residual risk | +| [CVE-2025-6638](https://github.com/advisories/GHSA-59p9-h35m-wg4g)
GHSA-59p9-h35m-wg4g, PYSEC-2026-1981 | MarianTokenizer.remove_language_code ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/marian/tokenization_marian.py` | < 4.53.0 → 4.53.0 | Marian tokenizer removes language codes; BART maps to BartTokenizer/Fast with separate vocab/merges byte BPE. Request text cannot select Marian tokenizer. Architecture-specific tokenizer; validate actual model/tokenizer config before full Not affected claim. | Mitigated with residual risk | +| [CVE-2025-3264](https://github.com/advisories/GHSA-jjph-296x-mrcr)
GHSA-jjph-296x-mrcr, PYSEC-2026-1985 | dynamic_module_utils.get_imports Python-source regex
`tools/summarizer/.venv/Lib/site-packages/transformers/dynamic_module_utils.py` | < 4.51.0 → 4.51.0 | Installed141 get_imports reads Python code. Auto factory540 executes dynamic module path only for has_remote_code and resolved trust_remote_code. Current app does not opt in, BART has local implementation; missing immutable artifact/config identity prevents universal dispatch proof. Fix4.51.0; upgrade candidate5.10.0. Explicitly deny remote code and qualify loader; do not conflate regex input with ordinary request text. | Fix available but blocked by compatibility | +| [CVE-2025-1194](https://github.com/advisories/GHSA-fpwr-67px-3qhx)
GHSA-fpwr-67px-3qhx, PYSEC-2026-1984 | SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py` | < 4.50.0 → 4.50.0 | Named GPT-NeoX-Japanese tokenizer exists as separate implementation; selected BART tokenizer uses byte BPE, not SubWordJapaneseTokenizer. Text cannot select tokenizer class directly. Do not label all tokenization ReDoS reachable merely because service tokenizes; actual family/config still needs identity. | Mitigated with residual risk | +| [CVE-2025-3777](https://github.com/advisories/GHSA-phhr-52qp-3mj4)
GHSA-phhr-52qp-3mj4, PYSEC-2026-1986 | image_utils video URL username validation
`tools/summarizer/.venv/Lib/site-packages/transformers/image_utils.py` | < 4.52.1 → 4.52.1 | Installed4.48.3 image_utils has load_image (HTTP image URL) but no load_video/YouTube helper; video_utils.py is absent. BART receives text only; uploaded image bytes handled by PIL/Tesseract in parser, never a Transformers media URL helper. No Transformers video/YouTube URL input route. CV text containing a URL is text, not automatically dereferenced by this helper. | Not affected with evidence | +| [CVE-2025-6051](https://github.com/advisories/GHSA-rcv9-qm8p-9p6j)
GHSA-rcv9-qm8p-9p6j, PYSEC-2026-1988 | CLVP EnglishNormalizer.normalize_numbers ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/clvp/number_normalizer.py` | < 4.53.0 → 4.53.0 | Actual normalize_numbers197 is CLVP text/audio normalizer; selected BART tokenizer has no EnglishNormalizer call. This is not generic normalize_text in parser_child.py. Keep distinct normalization owners and architecture scopes; model identity qualification remains needed. | Mitigated with residual risk | +| [CVE-2025-6921](https://github.com/advisories/GHSA-4w7r-h757-3r74)
GHSA-4w7r-h757-3r74, PYSEC-2026-1980 | AdamWeightDecay._do_use_weight_decay user regex
`tools/summarizer/.venv/Lib/site-packages/transformers/optimization_tf.py` | < 4.53.0 → 4.53.0 | TensorFlow training optimizer branch. Service performs torch.no_grad model.eval generation; no optimizer, training patterns or TensorFlow model conversion requested. No optimizer input boundary or training invocation; tensor generation length controls do not constitute the mitigation. | Not affected with evidence | +| [CVE-2025-3263](https://github.com/advisories/GHSA-q2wp-rjmx-x6x9)
GHSA-q2wp-rjmx-x6x9, PYSEC-2026-1987 | configuration_utils.get_configuration_file ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/configuration_utils.py` | < 4.51.0 → 4.51.0 | Installed1134 function consumes configuration_files list from model config in shared from_pretrained path. Fixed repository name reduces caller control but unpinned upstream/cache config remains an input; token length does not bound config filename regex. Patch4.51.0; selected candidate5.10.0 needs actual loader/tokenizer/model compatibility and immutable artifact evidence. | Fix available but blocked by compatibility | +| [CVE-2025-5197](https://github.com/advisories/GHSA-9356-575x-2w9m)
GHSA-9356-575x-2w9m, PYSEC-2026-1983 | convert_tf_weight_name_to_pt_weight_name ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_tf_pytorch_utils.py` | < 4.53.0 → 4.53.0 | Installed55 TF→PyTorch converter consumes tensor weight names; app default PyTorch from_pretrained does not request from_tf or TensorFlow conversion. Checkpoint download route does not automatically imply this conversion. Different converter; no user weight-name input. Reassess if cross-framework checkpoint conversion added. | Mitigated with residual risk | +| [CVE-2026-1839](https://github.com/advisories/GHSA-69w3-r845-3855)
GHSA-69w3-r845-3855, PYSEC-2026-2288 | Trainer._load_rng_state unsafe torch.load
`tools/summarizer/.venv/Lib/site-packages/transformers/trainer.py` | < 5.0.0rc3 → 5.0.0rc3 | Installed3081 helper loads training rng_state checkpoint; app uses no Trainer, training resume or optimizer. GHSA text additionally limits exploit to torch below2.6; observed metadata2.6.0 does not satisfy that textual condition, although database Transformers range still matches. Both operation separation and vendor torch<2.6 precondition; this does not clear independent torch weights_only flaw24747. | Not affected with evidence | +| [CVE-2026-4372](https://github.com/advisories/GHSA-29pf-2h5f-8g72)
GHSA-29pf-2h5f-8g72, PYSEC-2026-2289 | model initialization config attention-kernel code loading
`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py` | < 5.3.0 → 5.3.0 | Shared config attention field exists in4.48.3, but _autoset_attn_implementation1486 rejects non-eager/non-known attention values with ValueError1498. No Hub kernel download dispatch in that method. Vendor describes later kernel-repository execution via serialized field; broad <5.3 range needs version-specific confirmation. Strong source evidence of older allowlist differs from broad range; need negative runtime config test/patch-introduction evidence before scoped Not affected. Upgrade candidate fixes broad range but no compatibility pass here. | Unresolved | +| [CVE-2026-5241](https://access.redhat.com/errata/RHSA-2026:34456)
GHSA-fgcw-684q-jj6r, PYSEC-2026-2290 | LightGlue nested AutoConfig remote-code override
`tools/summarizer/.venv/Lib/site-packages/transformers/models/lightglue` | < 5.5.0 → 5.5.0 | No LightGlue files/package in installed4.48.3; installed AutoModelForSeq2SeqLM maps BART and not LightGlue. Vendor report describes5.2.0 despite broad<5.5 range. Named vulnerable architecture absent from installed distribution; candidate5.10 >=5.5 patch. This does not clear shared model-load vulnerabilities. | Not affected with evidence | +| [CVE-2026-9856](https://github.com/advisories/GHSA-xrqw-3rrv-vx5w)
GHSA-xrqw-3rrv-vx5w, PYSEC-2026-3929 | tokenizer/Processor save_pretrained chat_template traversal
`tools/summarizer/.venv/Lib/site-packages/transformers/tokenization_utils_base.py` | < 5.10.0 → 5.10.0 | save_pretrained exists, but application only from_pretrained, tokenizer call/decode, model.generate; no tokenizer/processor export or user save path. Cache download writes are Hub file_download, not save_pretrained. No named save path in service; retain broad installed-package advisory and require5.10 patch if export introduced. | Not affected with evidence | + +## Required qualification before a changed gate + +For filelock, exercise native/fallback locks, two contenders, stale marker handling and timeout on each supported platform. For torch/Transformers, qualify candidate wheel imports and dependency checks, actual BART tokenizer IDs/decode and benign selected-checkpoint generation, text truncation, resource behavior and safe unavailable-model503 behavior. Record immutable snapshot revision, format and hashes. Safe negative config/remote-code tests can establish behavior without executing malicious serialized payloads. A synthetic tiny BART test only proves that synthetic fixture. + +Refresh original aliases against the resolved lock, account for new advisories introduced by upgrades, preserve each no-fix/unresolved group and reconcile totals without adding duplicate aliases. A source-level scoped exemption needs reviewer acceptance; no package install, live provider call, production check or inference was performed in this research lane. diff --git a/docs/redesign/phase-9/p9-sec-02/CI_ASSESSMENT.md b/docs/redesign/phase-9/p9-sec-02/CI_ASSESSMENT.md new file mode 100644 index 0000000..925bb45 --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/CI_ASSESSMENT.md @@ -0,0 +1,59 @@ +# P9-SEC-02 hosted CI assessment — 25 October 2026 + +## Repository quarantine checkpoint + +After the read-only assessment below, the primary agent changed only `.gitea/workflows/mariadb-integration.yml`: removed automatic pull-request preparation, selected the unique `jobtracker-mariadb-isolated` label and added the current qualification branch to push coverage. The unconditional first-step exit1, database guards, image pin and existing test architecture remain. No runner host, registration, privilege, socket, service, backup or deployment workflow changed. Four new workflow invariant tests failed3/passed1 before the change and pass4/4 afterward; the existing five mocked runner tests also pass. The unique label is a routing prerequisite, not proof of a safe matching host. Hosted CI remains BLOCKED and current isolation UNVERIFIED pending operator/runtime evidence. The source hashes below describe the earlier read-only snapshot, not a claim that the workflow was unmodified afterward. + +**Hosted MariaDB: BLOCKED. Current runner isolation: UNVERIFIED.** Current effective HostConfig is unknown. Historical run853 was unsafe for this database lane; that observation does not certify today's configuration. No hosted MariaDB test or private-service lifecycle was executed by this assessment. + +Baseline `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8`, branch `fix/p9-model-cache-and-ci-qualification`. Fresh metadata observation **2026-10-25T06:23:27.915835Z / 07:23:27 CET Europe/Paris**. The user authorized bounded read-only CI/API and official-source investigation. Existing Git credentials were used only in memory with redirects refused; no helper output, Authorization header or credential values were retained. Repository permission is not host permission. + +## Fresh metadata and boundaries + +| Observation | Result | Meaning | +| --- | --- | --- | +| Version/repository | HTTP200; Gitea1.26.0; admin/push/pull reported | Readable repository metadata; no infrastructure authority established | +| Repository runners | HTTP200; runner3 `pi-runner-1`, offline, non-ephemeral, `ubuntu-latest`/`ubuntu-22.04` | Not the actual runner5 | +| Instance runners and user | Both HTTP403 | Runner5 configuration, registration scope and host remain inaccessible | +| Latest runs | Requested100; returned50 | Bounded window, not exhaustive history | +| New visible runs | [855](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/855)/[854](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/854), main `5f835e54a9b74e6b71418422e28431b2af06453f`, success | Job metadata names `backup`, runner5 `Live-Runner`; these are not MariaDB tests | +| Backup job times | Job1745 01:00:47–01:01:04UTC; job1744 00:01:21–00:01:38UTC,25October | Recent runner activity, not proof of its host boundary or production state | +| Current task branch | Branch query returns0; none in latest50 | No accessible branch execution in the inspected window; filter support/exhaustive absence not certified | +| Latest visible MariaDB run | Historical853/job1743 at3727a72, failure | Isolation guard failure before database execution, as established previously | + +Only metadata for these jobs was requested. Backup logs, secret endpoints, production hosts, daemon endpoints and runner host files were not accessed. Source workflow backup/deployment/maintenance jobs reference production SSH credentials and share `ubuntu-latest` with the blocked MariaDB workflow. Metadata now verifies that actual runner5 executes backup jobs. It does not establish host co-location, secret values or scopes, or job-to-job credential availability. + +## Historical runtime versus current unknown + +The [previous isolation report](../p9-remed-02/CI_ISOLATION.md) inspected24October run853: runner-reported v0.4.1, job image `node:20-bookworm`, merged **`NetworkMode:host` and `/var/run/docker.sock` bind**, `Privileged:false`, persistent tool cache. The guard exited1 before checkout/SDK/database work. Log SHA256 `448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134` identifies that historical evidence. The [earlier metadata refresh](../p9-remed-02/CI_REFRESH_2026-10-25.md) also did not inspect current HostConfig. + +This investigation downloaded no runtime logs and performed no live HostConfig inspection. Therefore historical exposure is **UNSAFE for the intended lane**, while today's isolation verdict is **UNVERIFIED**, rather than an assertion that current configuration is unchanged. No private-service success/failure/cancel/crash cleanup or cross-job leakage proof exists. + +## Source capability and preserved repository guards + +Fresh immutable upstream retrieval returned HTTP200 and matched all three previous source hashes: + +| Primary source | SHA256 | Relevant capability | +| --- | --- | --- | +| [Runner configuration at9aafec169b7ebf3d71df2b06780868fb552b435e](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml) | `e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa` | Lines86–115: automatic network, independent privilege/volume/options controls, `docker_host: "-"` to suppress socket mounting | +| [Runner execution](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go) | `857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590` | Lines220–248 pass secrets and container settings, disable reuse and request automatic removal | +| [act v0.261.10 engine](https://gitea.com/gitea/act/src/tag/v0.261.10/pkg/runner/run_context.go) | `45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c` | Lines116–121/309–401: generated network for services unless configured network overrides it, service DNS aliases, declared port bindings, normal cleanup attempts | + +The versioned Gitea documentation request returned403; no refreshed documentation contents are claimed. Pinned source proves supported capability, not installed binary identity, effective configuration, crash recovery or production egress separation. Services and runner-owned preparation precede workflow steps; an in-job guard cannot remove that exposure. + +Repository source review preserves the unconditional first-step exit1, existing branch filters, explicit failure rather than SQLite fallback, loopback TCP validation, generated schema ownership and cleanup failure propagation. The current task branch has no push trigger. Broad pull-request and manual triggers remain. Five existing Python guard tests passed with mocked subprocesses; their injected cleanup17/setup1 outputs are expected fixtures. Seven bounded source assertions passed. Neither check is a hosted or database test. Exact source hashes for eight relevant workflow/runner/fixture/Compose files are in [ci-assessment.json](ci-assessment.json). + +**Repository improvement proposal only:** consider removing the broad `pull_request` trigger while isolation is unverified, because the first failing step still allows runner preparation. This prevents an automatic event from preparing the known shared routing lane; manual triggering must remain operator-controlled. Review Gitea event behavior and dedicated routing before restoring it. No workflow or transport change was made here. A step-level bypass, adding Docker CLI, arbitrary remote endpoint exception, or routing to `ubuntu-latest` cannot safely close this gate. + +## Exact operator checklist before enabling execution + +1. On a **new dedicated nonproduction host/VM and daemon**, provide sanitized ownership, OS/image identity, runner binary version/hash and registration scope. Do not reconfigure Live-Runner under this task. Prove production workloads, data, secrets and management endpoints are absent and unreachable. Register a unique label such as `jobtracker-mariadb-isolated`; validate and pin the job image digest. +2. Generate configuration for the chosen exact binary. For the reviewed source capability, use empty `container.network`, `container.docker_host: "-"`, `privileged:false`, `valid_volumes:[]`, and no options reintroducing mounts, devices, host networking or privilege. Start capacity1; disable shared cache until qualified; use disposable per-job state. Only the controller manages its dedicated daemon; jobs/services receive no daemon endpoint/socket or registration/config credentials. +3. Prove effective **merged** job/service HostConfig, mounts, capabilities, network attachments, port bindings and resource limits. Establish explicit host firewall/egress and cross-job separation; a private Docker network alone does not deny production/LAN access. Review fork/PR trust, token permissions and secret scope without printing secrets. No production credentials may reach this lane. +4. Qualify native service `mariadb`, exact `mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00`, linux/amd64, development-only credentials and disposable storage. Declare no published ports or persistent DB volumes. Require bounded image health/authenticated readiness and exact version checks; prove job DNS `mariadb:3306` and generated schema ownership. +5. After infrastructure evidence, review workflow and fixture transport together: unique label, native service, preserved default loopback guard, strict CI-only service name `mariadb` and TCP3306. No arbitrary remote endpoint/self-attested isolation bypass. Retain startup migrations, independent persisted-state assertions, sanitized useful logs, native TRX, current exact test discovery and zero hidden retries/skips. Do not substitute historic test totals. +6. Execute success, deliberate test failure, cancellation and interrupted-runner recovery. Retain job-scoped before/after resource inventories proving service/container/network/schema/data removal, no stale credentials/cache and no cross-job access. Document targeted orphan reclamation after daemon/runner failure without broad prune operations or production effects. Then execute and publish the actual hosted MariaDB lane at its exact source/image identities. + +Hosted PASS requires real MariaDB test execution **and** verified isolation/lifecycle evidence. Current owner action is infrastructure proof followed by reviewed repository enabling changes and actual execution. API success, backup success, labels, source examples, mocked guards and local MariaDB qualification do not satisfy it. Production release remains an independent gate. + +Raw bounded metadata, source bytes and manifests are retained under `.artifacts/p9-sec-02/ci/`; [ci-assessment.json](ci-assessment.json) records response and source hashes, actual permission failures, limitations and actions. No workflow dispatch, host mutation, Docker socket use, secret-value/log access, database operation or deployment occurred. diff --git a/docs/redesign/phase-9/p9-sec-02/MODEL_CACHE.md b/docs/redesign/phase-9/p9-sec-02/MODEL_CACHE.md new file mode 100644 index 0000000..c9f6631 --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/MODEL_CACHE.md @@ -0,0 +1,23 @@ +# Model/cache qualification architecture and fixture identity + +Source baselinef17dba2,25October2026. Actual Python consumers are `AutoTokenizer` and `AutoModelForSeq2SeqLM` for fixed BART summarisation in `tools/summarizer/app.py:96`; they initialise lazily, or eagerly only under the existing environment flag. Document parsing uses pypdf/PyMuPDF/python-docx/Pillow and resource-bounded child processes. OCR uses the native Tesseract executable and its English traineddata, not a Transformers OCR model. No Python embedding/reranking/Docling model is implemented in this source. Ollama is an HTTP client boundary with its own separately managed model storage; no Ollama model/cache/server was accessed. + +The selected full repository `sshleifer/distilbart-cnn-12-6` advertises Apache-2.0 and immutable revision `a4f8f3ea906ed274767e9906dbaede7531d660ff`. Its1,222,317,369-byte PyTorch checkpoint has authoritative LFS SHA256 `3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea`. It was not available in the checked local user cache or existing local sidecar image. Local Docker context is desktop-linux; the only volume is the distinct MariaDB development volume. No production filesystem/cache was inspected. Old image contents are not approved current-runtime artifacts. + +## Small task-authorised fixtures + +[ARTIFACTS.json](model/ARTIFACTS.json) records two independently hashed, isolated fixtures. Their tokenizer/vocabulary/merges/model-card and reference configuration come from the immutable upstream revision. Every downloaded ordinary Git file is checked against the published Git blob identity, then pinned with SHA256. Only1,358,673 bytes of upstream metadata/tokenizer content were downloaded. No pretrained checkpoint or remote Python code was downloaded. + +Synthetic BART weights are generated locally with fixed seed73421 using the Apache-2.0 Transformers BART implementation: vocabulary50265, dimension16, one encoder/decoder layer, two heads,32-wide feed-forward layers and1024 positions. The842704 parameters are saved once as Safetensors and once as a known state dictionary. These files are approximately3.58MB each. The second format exercises the same PyTorch serialization family as the selected full checkpoint, with explicit `weights_only=True`. No third-party pickle or trained-weight licence is assumed. The actual tokenizer's Apache-2.0 declaration is preserved from its pinned card; no model weights are redistributed in Git. + +These are real native BART/tokenizer/generation artifacts, with deliberately untrained/random outputs. They establish the tested library/API/format/CPU compatibility scope. They do not establish full DistilBART output quality, production memory/latency, GPU compatibility, intended model semantics or C11/P5-13 acceptance. No owner approval of a production model or formal risk exception is implied by task-authorised test preparation. + +The committed manifest is the integrity authority, not an arbitrary cache-local JSON file. The verifier rejects missing/corrupt/linked/duplicate/traversal/unlisted artifacts before loading. The fixture mount is read-only; runtime networking is none, with explicit Hub/Transformers offline flags, private tmpfs cache and twoCPU/2GiB/128PID limits. Each container has an owned label, bounded parent deadline and removal verification. Replacing source/checkpoint identities requires a new manifest and qualification. + +The production model choice is unchanged. A minimal loader repair now pins tokenizer and weights to the same reviewed revision, denies remote code and explicitly requests restricted weights loading. Its new unit test failed for the missing revision before the repair; the complete native Windows suite passed59 cases afterward. That suite alone is not real-model evidence; Linux fixture inference is separate. + +## Cache ownership and supported transition + +filelock4 changes shared-cache lock protocols. All qualification caches are new isolated disposable directories with a single library generation. No production or developer cache was reset, rewritten or silently mixed with old lock participants. A later production rollout must stop old participants and explicitly select a separately prepared/verified cache or establish documented protocol migration compatibility. That operator action is separate from development fixture compatibility and remains withheld. + +Actual compatibility, negative/offline/cache contention/OCR results and any limitations are recorded separately as they execute. The full checkpoint remains absent; no large download was used to manufacture a qualification claim. diff --git a/docs/redesign/phase-9/p9-sec-02/PLAN.md b/docs/redesign/phase-9/p9-sec-02/PLAN.md new file mode 100644 index 0000000..010a8ab --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/PLAN.md @@ -0,0 +1,16 @@ +# P9-SEC-02 — model/cache and CI qualification + +Baseline: `f17dba2ec06ea8f53c2785eaaebd25abc515ebf8`; branch `fix/p9-model-cache-and-ci-qualification`; date25October2026. The user's P9-SEC-02 mission is the authority. Preserve historical acceptance reports, main, production resources, existing routes and all57 preservation groups. + +- SEC-M01: verify baseline evidence and individually assess the remaining44 advisory groups, retaining original109/previous65 accounting and current exact-pin sources. +- SEC-M02: trace actual model/OCR/cache owners; select the smallest trusted, licensed, immutable nonproduction artifacts that adequately test compatibility. Existing caches are read-only inputs, never disposable stores. No production/Ollama access or large unnecessary download. +- SEC-M03: qualify compatible patched dependencies with real CPU loading/processing, integrity/offline/failure/resource tests, exact locks and parser/sidecar regressions. Record full-model versus small-fixture scope separately. +- CI-M01: inspect hosted metadata/configuration read-only; preserve guards; document operator-owned isolated-runner prerequisites when live execution cannot be verified. +- REG-M01: run applicable full source-bound regressions serially; separate native discovery, contract, MariaDB, model, PDF, security and human outcomes. Never add focused reruns to full totals. +- P9-M01: publish dated acceptance, individual gate verdicts, owner blockers, checkpoint commits and verified normal pushes. No merge/deployment/CV-UX/CV-IMPORT/Phase10 implementation. + +Every new validation branch leaves a negative test or bounded assert self-check. No formal security risk is accepted for the owner. Any unqualified production-only condition remains a separate release gate. + +Ruling: reuse the verified clean dedicated development checkout and create the user-named branch fromf17dba2; no second checkout is needed for isolation from main. Cost if wrong: concurrent edits would require stopping and preserving the other owner's work. + +Historical baseline counts are evidence to verify, not newly executed tests. Raw new evidence belongs in `.artifacts/p9-sec-02/`; each attempt gets a fresh output directory. diff --git a/docs/redesign/phase-9/p9-sec-02/PROGRESS.md b/docs/redesign/phase-9/p9-sec-02/PROGRESS.md new file mode 100644 index 0000000..be0a65c --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/PROGRESS.md @@ -0,0 +1,15 @@ +# P9-SEC-02 progress ledger + +25October2026: clean checkout and origin verified atf17dba2; main5f835e54 unchanged; dedicated requested branch created. Read prior acceptance and Python remediation; none of the historical test counts are claimed fresh. + +SEC-M01 / SEC-M02 investigation in progress. CI-M01 is an independent read-only assessment. No dependency/application change yet. + +SEC-M01: all44 remaining groups individually researched;109=65+44 retained. Research dispositions are provisional until runtime/version evidence is integrated. Official sources and hashes preserved, including rate-limit failures. + +SEC-M02: pinned licensed tokenizer/metadata and two locally generated BART state formats prepared with manifests. No large model download or live cache access. Five integrity-negative unit checks PASS. Full DistilBART remains absent and no semantic/full-size/GPU claim is made. + +CI-M01: read-only assessment complete; hosted BLOCKED/current isolation UNVERIFIED. Safe repository quarantine selects a unique dedicated label, removes broad PR preparation and retains unconditional exit1. Workflow tests RED3/1 then GREEN4/4; existing mocked runner guards5/5 PASS. No host/deployment changes. + +SEC-M03 in progress: candidate55-package CPU lock resolves;110 exact advisory requests report0 records with the known exact-vendor PyPI404 retained. Both real offline BART serialization profiles PASS, including summary/auth/repeat-cache contract. Complete Linux suite initially52PASS/7FAIL because harness supplied an empty Ollama URL; retained predecessor. Corrected isolated loopback fixture passes59/59 with one documented Starlette/httpx deprecation. Current production requirements are not yet replaced by this candidate. + +Shared loader pin repair: new unit test failed missing immutable revision, then complete native Windows suite59/59 PASS. Tokenizer/model now share immutable revision, deny remote code and request weights_only. Same model identity, no deployment or output-quality acceptance. diff --git a/docs/redesign/phase-9/p9-sec-02/advisory-research.json b/docs/redesign/phase-9/p9-sec-02/advisory-research.json new file mode 100644 index 0000000..3e0989a --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/advisory-research.json @@ -0,0 +1,21079 @@ +{ + "schemaVersion": 1, + "generatedUtc": "2026-10-25T06:31:17.051426+00:00", + "gate": "RESEARCH_ONLY_NOT_ACCEPTANCE", + "scope": "Remaining44 baseline alias groups only; installed Windows source paths and official vendor/security refresh. No application changes, package installs, inference/model download, production/Ollama/paid-provider requests.", + "baselineAccounting": { + "originalAliasGroups": 109, + "previouslyRemovedAliasGroups": 65, + "remainingAliasGroups": 44, + "remainingByPackage": { + "filelock": 3, + "torch": 19, + "transformers": 22 + }, + "priorBeforeProviderRecords": 249, + "priorAfterProviderRecords": 99, + "newRuntimeQualificationPasses": 0 + }, + "installedMetadataAtResearch": { + "torch": [ + { + "path": "tools/summarizer/.venv/Lib/site-packages/torch-2.6.0.dist-info/METADATA", + "sha256": "93dc21037466ff9efa2f7959525342c524e62d53f4f9fe908ae9e388557eaf7c", + "version": "2.6.0" + } + ], + "transformers": [ + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers-4.48.3.dist-info/METADATA", + "sha256": "2e2780d2f5328a387fd8676aa6fb4d252acf551cb4d5d4eed490b443c5e5eaa6", + "version": "4.48.3" + } + ], + "filelock": [ + { + "path": "tools/summarizer/.venv/Lib/site-packages/filelock-3.32.4.dist-info/METADATA", + "sha256": "3537e7b9982e7c24c535067af50a7d7ecb2ca4abba8aac40616793f2956d6482", + "version": "3.32.4" + } + ], + "huggingface_hub": [ + { + "path": "tools/summarizer/.venv/Lib/site-packages/huggingface_hub-0.36.2.dist-info/METADATA", + "sha256": "4dc2b0a3fb27bcba8b091f98bccff4b94369d269c9768aeaecd0b99d970665d9", + "version": "0.36.2" + } + ], + "tokenizers": [ + { + "path": "tools/summarizer/.venv/Lib/site-packages/tokenizers-0.21.4.dist-info/METADATA", + "sha256": "ce3ba043e5263c19b034386688782dd8a6c103f951c26e407e0e1aff0a629ef1", + "version": "0.21.4" + } + ] + }, + "candidatePatchedGraph": { + "filelock": { + "version": "4.2.1", + "requiresPython": ">=3.11", + "requiresDistBase": [], + "metadataEvidence": ".artifacts/p9-sec-02/advisory-research/filelock-candidate-cb0b1dd4.raw", + "status": "Candidate only; no compatibility PASS or dependency installation performed in this lane." + }, + "torch": { + "version": "2.13.0", + "requiresPython": ">=3.10", + "requiresDistBase": [ + "filelock", + "typing-extensions>=4.10.0", + "setuptools>=77.0.3", + "sympy>=1.13.3", + "networkx>=2.5.1", + "jinja2", + "fsspec>=0.8.5", + "cuda-toolkit[cublas,cudart,cufft,cufile,cupti,curand,cusolver,cusparse,nvjitlink,nvrtc,nvtx]==13.0.3; platform_system == \"Linux\"", + "cuda-bindings<14,>=13.0.3; platform_system == \"Linux\" and python_version < \"3.15\"", + "nvidia-cudnn-cu13==9.20.0.48; platform_system == \"Linux\"", + "nvidia-cusparselt-cu13==0.8.1; platform_system == \"Linux\"", + "nvidia-nccl-cu13==2.29.7; platform_system == \"Linux\"", + "nvidia-nvshmem-cu13==3.4.5; platform_system == \"Linux\"", + "triton==3.7.1; platform_system == \"Linux\" and python_version < \"3.15\"" + ], + "metadataEvidence": ".artifacts/p9-sec-02/advisory-research/torch-candidate-9cf3ca2a.raw", + "status": "Candidate only; no compatibility PASS or dependency installation performed in this lane." + }, + "transformers": { + "version": "5.10.0", + "requiresPython": ">=3.10.0", + "requiresDistBase": [ + "huggingface-hub<2.0,>=1.5.0", + "numpy>=1.17", + "packaging>=20.0", + "pyyaml>=5.1", + "regex>=2025.10.22", + "tokenizers<=0.23.0,>=0.22.0", + "typer", + "safetensors>=0.4.3", + "tqdm>=4.27" + ], + "metadataEvidence": ".artifacts/p9-sec-02/advisory-research/transformers-candidate-ebca8555.raw", + "status": "Candidate only; no compatibility PASS or dependency installation performed in this lane." + } + }, + "candidateGraphCaveats": [ + "CPU vendor torch2.13.0+cpu wheels advertised for cp312 Windows amd64 and manylinux_2_28 x86_64; PyPI generic torch2.13 Linux metadata brings CUDA13. Use vendor CPU wheel identity, hash and matching platform. No wheel installed here.", + "Transformers5.10 requires hub>=1.5,<2; tokenizers>=0.22,<=0.23; regex>=2025.10.22 and typer. Resolve whole graph in isolation, constrain existing unrelated security patches, record all new transitive pins/hashes. Existing hub0.36.2/tokenizers0.21.4 do not satisfy it.", + "Published max fix is torch2.13.0, transformers5.10.0, filelock4.2.1. These are lower-bound candidate versions for the fixable ranges, not assertion that all44 clear. Eight ZDI groups and torch.pt2 group have no published fix event; numeric-correctness record55554 has vendor/provider discrepancy.", + "Candidate Transformers tagged source retains AutoModelForSeq2SeqLM and BART mapping; this is source compatibility only, not successful import or inference.", + "Installed torch METADATA2.6.0 differs from lock2.6.0+cpu; do not silently equate Windows installed distribution with Linux vendor wheel." + ], + "modelArtifactIdentityGap": "App hard-codes sshleifer/distilbart-cnn-12-6 but does not supply immutable revision, use_safetensors=True, local_files_only, trust_remote_code=False or artifact SHA manifest. Default remote-code rejection/local BART mapping reduce exposure but do not establish downloaded config/checkpoint identity. Actual cache snapshot revision, artifact format and hashes must be recorded separately; do not load/download a model in this lane.", + "sharedSources": [ + { + "path": "tools/summarizer/.venv/Lib/site-packages/huggingface_hub/utils/_fixes.py", + "exists": true, + "sha256": "c50575424527d96a4ba8b8ed5cd8b29fd821fb8e782ba005f90de4c24600403f", + "symbolMatches": [ + { + "line": 22, + "text": "from filelock import BaseFileLock, FileLock, SoftFileLock, Timeout" + }, + { + "line": 87, + "text": "def WeakFileLock(" + }, + { + "line": 94, + "text": " 2. It will default to a SoftFileLock if the filesystem does not support flock." + }, + { + "line": 115, + "text": " if \"use SoftFileLock instead\" in str(e):" + }, + { + "line": 117, + "text": " \"FileSystem does not appear to support flock. Falling back to SoftFileLock for %s\", lock_file" + }, + { + "line": 119, + "text": " lock = SoftFileLock(lock_file, timeout=log_interval)" + } + ] + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/huggingface_hub/file_download.py", + "exists": true, + "sha256": "0bbe85320d5183be34d4af54a703809c5775506da4a346cbf40112da633b36d8", + "symbolMatches": [ + { + "line": 39, + "text": " WeakFileLock," + }, + { + "line": 1167, + "text": " with WeakFileLock(lock_path):" + }, + { + "line": 1174, + "text": " with WeakFileLock(lock_path):" + }, + { + "line": 1295, + "text": " with WeakFileLock(paths.lock_path):" + }, + { + "line": 1302, + "text": " with WeakFileLock(paths.lock_path):" + } + ] + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/auto/auto_factory.py", + "exists": true, + "sha256": "c017394b364a5750b1c91dd1ce8712f55af89021c2a8cd17053aad8698e781bd", + "symbolMatches": [ + { + "line": 89, + "text": " The model is set in evaluation mode by default using `model.eval()` (so for instance, dropout modules are" + } + ] + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/auto/modeling_auto.py", + "exists": true, + "sha256": "ff748715545046d13b34a0ff613a7c08f79300c2ca3b5705580dd83bff17a65b" + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/auto/tokenization_auto.py", + "exists": true, + "sha256": "852e6866e4ea2d239d739c808092251c2c5a02f567e7a4770c275c9284cc90d6" + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/bart/modeling_bart.py", + "exists": true, + "sha256": "fd02ce94513538fad02df0e774f10d66660cf8eaf35edec4acab6b676778b894", + "symbolMatches": [ + { + "line": 132, + "text": "class BartAttention(nn.Module):" + }, + { + "line": 416, + "text": "class BartSdpaAttention(BartAttention):" + }, + { + "line": 490, + "text": " # in SDPA to support both torch.compile's dynamic shapes and full graph options. An inline conditional prevents dynamic shapes from compiling." + }, + { + "line": 529, + "text": "class BartEncoderLayer(nn.Module):" + }, + { + "line": 599, + "text": "class BartDecoderLayer(nn.Module):" + }, + { + "line": 1560, + "text": "class BartForConditionalGeneration(BartPreTrainedModel, GenerationMixin):" + } + ] + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/bart/tokenization_bart.py", + "exists": true, + "sha256": "238e87cee4f46a9230d89305c92e48cb880c6e62cd1eab7bc3113f32a5570a63", + "symbolMatches": [ + { + "line": 74, + "text": "class BartTokenizer(PreTrainedTokenizer):" + } + ] + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py", + "exists": true, + "sha256": "977e5f089928f6a4dd4db0270e411c898921c7cd6ba6d12e1c3f88a1916c5820", + "symbolMatches": [ + { + "line": 479, + "text": " loader = safe_load_file if load_safe else partial(torch.load, map_location=\"cpu\", **weights_only_kwarg)" + }, + { + "line": 493, + "text": "def load_state_dict(" + }, + { + "line": 535, + "text": " return torch.load(" + }, + { + "line": 665, + "text": " def load(module: nn.Module, state_dict, prefix=\"\", assign_to_params_buffers=False):" + }, + { + "line": 1424, + "text": " if config._attn_implementation_internal is not None:" + }, + { + "line": 1427, + "text": " attn_implementation = config._attn_implementation_internal" + }, + { + "line": 1460, + "text": " def _autoset_attn_implementation(" + }, + { + "line": 1475, + "text": " # Here we use config._attn_implementation_internal to check whether the attention implementation was explicitely set by the user." + }, + { + "line": 1479, + "text": " if hasattr(config, \"_attn_implementation_internal\") and config._attn_implementation_internal is not None:" + }, + { + "line": 1501, + "text": " requested_attn_implementation = config._attn_implementation_internal" + }, + { + "line": 1516, + "text": " sub_config._attn_implementation_internal = curr_attn_implementation" + }, + { + "line": 2618, + "text": " def save_pretrained(" + }, + { + "line": 3151, + "text": " The model is set in evaluation mode by default using `model.eval()` (Dropout modules are deactivated). To train" + }, + { + "line": 4269, + "text": " model.eval()" + }, + { + "line": 5064, + "text": " if is_torch_fx_proxy(input_ids) or torch.jit.is_tracing() or is_torchdynamo_compiling():" + }, + { + "line": 5163, + "text": " \"\"\"Return a `torch.compile`'d version of `self.__call__`. This is useful to dynamically choose between" + }, + { + "line": 5174, + "text": " self._compiled_call = torch.compile(self.__call__, **compile_config.to_dict())" + } + ] + }, + { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/configuration_utils.py", + "exists": true, + "sha256": "928b493592af43ff930cfbcd63619f93cd09ce522ca9482a54bd11a7a8fce825", + "symbolMatches": [ + { + "line": 304, + "text": " self._attn_implementation_internal = kwargs.pop(\"attn_implementation\", None)" + }, + { + "line": 358, + "text": " if hasattr(self, \"_attn_implementation_internal\"):" + }, + { + "line": 359, + "text": " if self._attn_implementation_internal is None:" + }, + { + "line": 363, + "text": " return self._attn_implementation_internal" + }, + { + "line": 369, + "text": " self._attn_implementation_internal = value" + }, + { + "line": 371, + "text": " def save_pretrained(self, save_directory: Union[str, os.PathLike], push_to_hub: bool = False, **kwargs):" + }, + { + "line": 858, + "text": " if \"_attn_implementation_internal\" in serializable_config_dict:" + }, + { + "line": 859, + "text": " del serializable_config_dict[\"_attn_implementation_internal\"]" + }, + { + "line": 880, + "text": " if \"_attn_implementation_internal\" in output:" + }, + { + "line": 881, + "text": " del output[\"_attn_implementation_internal\"]" + }, + { + "line": 1134, + "text": "def get_configuration_file(configuration_files: List[str]) -> str:" + } + ] + } + ], + "dispositionCounts": { + "Not affected with evidence": 8, + "Fix available but blocked by compatibility": 5, + "Mitigated with residual risk": 20, + "Unresolved": 2, + "No fix": 9 + }, + "dispositionDefinitions": { + "Fixed verified": "No entries: no patched graph qualification performed by researcher.", + "Not affected with evidence": "Named operation absent from scoped service route or vulnerable architecture absent, supported by actual installed source; affected package range remains visible.", + "Mitigated with residual risk": "Operation/compiler/architecture differs from intended BART path, but package still affected and runtime/artifact identity not proven.", + "Fix available but blocked by compatibility": "Published patch exists; migration/selected-model/cache qualification pending. This does not assert incompatibility was experimentally demonstrated.", + "No fix": "No released patch verified from refreshed primary sources. Existing scoped mitigations described per entry.", + "Unresolved": "Conflicting vendor/provider evidence or broad range not sufficiently reconciled with installed implementation.", + "Owner risk acceptance": "No entries; only user can accept residual risk." + }, + "advisories": [ + { + "groupId": "CVE-2026-112940", + "package": "filelock", + "identifiers": [ + "CVE-2026-112940", + "GHSA-v4x8-3wr5-3wq8" + ], + "baselineLockedVersion": "3.32.4", + "currentLockedVersionAtResearch": "3.32.4", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-v4x8-3wr5-3wq8", + "affected": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.20.4" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.20.4", + "3.21.0", + "3.21.1", + "3.21.2", + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v4x8-3wr5-3wq8/GHSA-v4x8-3wr5-3wq8.json" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.2.1" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "filelock" + }, + "vulnerable_version_range": ">= 3.20.4, <= 4.2.0", + "first_patched_version": "4.2.1", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-10-23T21:59:11Z", + "refreshedOsvId": "GHSA-v4x8-3wr5-3wq8", + "refreshedOsvModified": "2026-10-23T22:15:04.432475030Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.20.4" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.20.4", + "3.21.0", + "3.21.1", + "3.21.2", + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v4x8-3wr5-3wq8/GHSA-v4x8-3wr5-3wq8.json", + "last_known_affected_version_range": "<= 4.2.0" + } + } + ], + "vulnerableFunction": "ReadWriteLock SQLite database reopen and POSIX symlink/side-file handling", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py", + "exists": true, + "sha256": "3c194b83f7db92a0dca51c89e4d91982858b47d0c450733ed6c43306766c383f", + "symbolMatches": [ + { + "line": 107, + "text": " \"ReadWriteLock is unavailable in a PyPy fork child; exec or exit before using it\"" + }, + { + "line": 179, + "text": "class _ReadWriteLockMeta(type):" + }, + { + "line": 183, + "text": " This logic lives here rather than in ReadWriteLock.get_lock so ``ReadWriteLock(path)`` returns cached instances" + }, + { + "line": 188, + "text": " _instances: WeakValueDictionary[pathlib.Path, ReadWriteLock]" + }, + { + "line": 200, + "text": " ) -> ReadWriteLock:" + }, + { + "line": 208, + "text": " msg = \"ReadWriteLock construction cannot continue after fork\"" + }, + { + "line": 226, + "text": " msg = \"ReadWriteLock construction cannot continue after fork\"" + }, + { + "line": 247, + "text": "class ReadWriteLock(metaclass=_ReadWriteLockMeta):" + }, + { + "line": 256, + "text": " By default, ``is_singleton=True``: calling ``ReadWriteLock(path)`` with the same resolved path returns the same" + }, + { + "line": 269, + "text": " _instances: WeakValueDictionary[pathlib.Path, ReadWriteLock] = WeakValueDictionary()" + }, + { + "line": 285, + "text": " ) -> ReadWriteLock:" + }, + { + "line": 287, + "text": " Return the singleton :class:`ReadWriteLock` for *lock_file*." + }, + { + "line": 306, + "text": " is_singleton: bool = True, # ruff:ignore[unused-method-argument] # consumed by _ReadWriteLockMeta.__call__" + }, + { + "line": 494, + "text": " msg = f\"ReadWriteLock on {self.lock_file} was invalidated by fork(); construct a new instance\"" + }, + { + "line": 509, + "text": " msg = f\"Cannot acquire ReadWriteLock on {self.lock_file} while acquisition is active in this thread\"" + }, + { + "line": 715, + "text": " msg = f\"Cannot {operation} ReadWriteLock on {self.lock_file} while acquisition is active in this thread\"" + }, + { + "line": 720, + "text": " msg = f\"ReadWriteLock on {self.lock_file} was invalidated by fork(); construct a new instance\"" + }, + { + "line": 774, + "text": "_register_fork_class(ReadWriteLock)" + }, + { + "line": 781, + "text": " \"ReadWriteLock\"," + } + ] + }, + "actualCallPathAndUntrustedReachability": "SQLite-backed ReadWriteLock is a different lock type from Hub WeakFileLock; installed Hub _fixes.py constructs FileLock then SoftFileLock. Remote document text cannot choose lock type or database filename. No ReadWriteLock application import/call.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Scoped service lock selection excludes this SQLite API; package remains in affected range. Reassess if reader/writer locks are introduced.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Windows native and forced soft fallback; two contenders mutual exclusion; contention timeout; stale marker; local cache permissions. Linux flock/fallback and fresh Hugging Face cache in isolated development environment.", + "primarySources": [ + "https://github.com/advisories/GHSA-v4x8-3wr5-3wq8", + "https://github.com/tox-dev/filelock", + "https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d", + "https://github.com/tox-dev/filelock/pull/834", + "https://github.com/tox-dev/filelock/releases/tag/4.2.1", + "https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8", + "https://nvd.nist.gov/vuln/detail/CVE-2026-112940", + "https://osv.dev/vulnerability/GHSA-v4x8-3wr5-3wq8" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-v4x8-3wr5-3wq8", + "retrievedUtc": "2026-10-25T06:30:27.503315+00:00", + "status": 200, + "sha256": "30104198d8651c14d1055a1ffc696184b6994504b9d34862636ad4617493fd40", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-v4x8-3wr5-3wq8-osv-3bfe7544.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-v4x8-3wr5-3wq8", + "retrievedUtc": "2026-10-25T06:30:27.504320+00:00", + "status": 200, + "sha256": "3febff3b5661fd310f06d64bbc8ec1b8fc199e04e0851f3dd3f00840a5f5c4c1", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-v4x8-3wr5-3wq8-dcf9715b.raw" + }, + { + "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8", + "retrievedUtc": "2026-10-25T06:30:27.504821+00:00", + "status": 200, + "sha256": "7df97f01a624b4db0693818d6a8a1542584e087a934e5571d689a2b6e1a14a8b", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2026-112940-vendor-8d9e33b0.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.2.1" + ] + }, + { + "groupId": "CVE-2026-112913", + "package": "filelock", + "identifiers": [ + "CVE-2026-112913", + "GHSA-9vhv-jxww-xfm5" + ], + "baselineLockedVersion": "3.32.4", + "currentLockedVersionAtResearch": "3.32.4", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-9vhv-jxww-xfm5", + "affected": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.20.4" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.20.4", + "3.21.0", + "3.21.1", + "3.21.2", + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9vhv-jxww-xfm5/GHSA-9vhv-jxww-xfm5.json" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.2.1" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "filelock" + }, + "vulnerable_version_range": ">= 3.20.4, <= 4.2.0", + "first_patched_version": "4.2.1", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-10-23T22:28:20Z", + "refreshedOsvId": "GHSA-9vhv-jxww-xfm5", + "refreshedOsvModified": "2026-10-23T22:45:03.439584635Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.20.4" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.20.4", + "3.21.0", + "3.21.1", + "3.21.2", + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.0", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9vhv-jxww-xfm5/GHSA-9vhv-jxww-xfm5.json" + } + } + ], + "vulnerableFunction": "ReadWriteLock Windows SQLite -wal/-journal/-shm handling", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py", + "exists": true, + "sha256": "3c194b83f7db92a0dca51c89e4d91982858b47d0c450733ed6c43306766c383f", + "symbolMatches": [ + { + "line": 107, + "text": " \"ReadWriteLock is unavailable in a PyPy fork child; exec or exit before using it\"" + }, + { + "line": 179, + "text": "class _ReadWriteLockMeta(type):" + }, + { + "line": 183, + "text": " This logic lives here rather than in ReadWriteLock.get_lock so ``ReadWriteLock(path)`` returns cached instances" + }, + { + "line": 188, + "text": " _instances: WeakValueDictionary[pathlib.Path, ReadWriteLock]" + }, + { + "line": 200, + "text": " ) -> ReadWriteLock:" + }, + { + "line": 208, + "text": " msg = \"ReadWriteLock construction cannot continue after fork\"" + }, + { + "line": 226, + "text": " msg = \"ReadWriteLock construction cannot continue after fork\"" + }, + { + "line": 247, + "text": "class ReadWriteLock(metaclass=_ReadWriteLockMeta):" + }, + { + "line": 256, + "text": " By default, ``is_singleton=True``: calling ``ReadWriteLock(path)`` with the same resolved path returns the same" + }, + { + "line": 269, + "text": " _instances: WeakValueDictionary[pathlib.Path, ReadWriteLock] = WeakValueDictionary()" + }, + { + "line": 285, + "text": " ) -> ReadWriteLock:" + }, + { + "line": 287, + "text": " Return the singleton :class:`ReadWriteLock` for *lock_file*." + }, + { + "line": 306, + "text": " is_singleton: bool = True, # ruff:ignore[unused-method-argument] # consumed by _ReadWriteLockMeta.__call__" + }, + { + "line": 494, + "text": " msg = f\"ReadWriteLock on {self.lock_file} was invalidated by fork(); construct a new instance\"" + }, + { + "line": 509, + "text": " msg = f\"Cannot acquire ReadWriteLock on {self.lock_file} while acquisition is active in this thread\"" + }, + { + "line": 715, + "text": " msg = f\"Cannot {operation} ReadWriteLock on {self.lock_file} while acquisition is active in this thread\"" + }, + { + "line": 720, + "text": " msg = f\"ReadWriteLock on {self.lock_file} was invalidated by fork(); construct a new instance\"" + }, + { + "line": 774, + "text": "_register_fork_class(ReadWriteLock)" + }, + { + "line": 781, + "text": " \"ReadWriteLock\"," + } + ] + }, + "actualCallPathAndUntrustedReachability": "Requires local attacker-created SQLite side files in shared writable directory. Current cache helper uses native FileLock or SoftFileLock, not SQLite ReadWriteLock; parser has no filelock import.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Service call graph excludes ReadWriteLock, not all uses of filelock. Cache directory permissions are not claimed verified.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Windows native and forced soft fallback; two contenders mutual exclusion; contention timeout; stale marker; local cache permissions. Linux flock/fallback and fresh Hugging Face cache in isolated development environment.", + "primarySources": [ + "https://github.com/advisories/GHSA-9vhv-jxww-xfm5", + "https://github.com/tox-dev/filelock", + "https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d", + "https://github.com/tox-dev/filelock/pull/834", + "https://github.com/tox-dev/filelock/releases/tag/4.2.1", + "https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5", + "https://osv.dev/vulnerability/GHSA-9vhv-jxww-xfm5" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-9vhv-jxww-xfm5", + "retrievedUtc": "2026-10-25T06:30:27.505320+00:00", + "status": 200, + "sha256": "8ce24d13ce3fd2b6cbca1b71fa074c9ab4582a2547dd9a89248bc20bbf318746", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-9vhv-jxww-xfm5-osv-0b192f2f.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-9vhv-jxww-xfm5", + "retrievedUtc": "2026-10-25T06:30:27.555879+00:00", + "status": 200, + "sha256": "80807e4eadb9ff03fcff60f17eefe93e45a7161d8ee528384da544b57745bc84", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-9vhv-jxww-xfm5-30ab2732.raw" + }, + { + "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5", + "retrievedUtc": "2026-10-25T06:30:27.581705+00:00", + "status": 200, + "sha256": "cf4e42aa25032eac5f12b841e705190aed58faaa55a3281a9b8772eceb25df9f", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2026-112913-vendor-1dbf66b9.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.2.1" + ] + }, + { + "groupId": "CVE-2026-112907", + "package": "filelock", + "identifiers": [ + "CVE-2026-112907", + "GHSA-567q-5qvw-pf92" + ], + "baselineLockedVersion": "3.32.4", + "currentLockedVersionAtResearch": "3.32.4", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-567q-5qvw-pf92", + "affected": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.22.0" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-567q-5qvw-pf92/GHSA-567q-5qvw-pf92.json", + "last_known_affected_version_range": "<= 4.2.0" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.2.1" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "filelock" + }, + "vulnerable_version_range": ">= 3.22.0, <= 4.2.0", + "first_patched_version": "4.2.1", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-10-23T22:27:34Z", + "refreshedOsvId": "GHSA-567q-5qvw-pf92", + "refreshedOsvModified": "2026-10-23T22:45:03.452878321Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "filelock", + "ecosystem": "PyPI", + "purl": "pkg:pypi/filelock" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.22.0" + }, + { + "fixed": "4.2.1" + } + ] + } + ], + "versions": [ + "3.22.0", + "3.23.0", + "3.24.0", + "3.24.1", + "3.24.2", + "3.24.3", + "3.25.0", + "3.25.1", + "3.25.2", + "3.28.0", + "3.29.0", + "3.29.1", + "3.29.2", + "3.29.3", + "3.29.4", + "3.29.5", + "3.29.6", + "3.29.7", + "3.30.0", + "3.30.1", + "3.30.2", + "3.30.3", + "3.31.0", + "3.31.1", + "3.31.2", + "3.32.0", + "3.32.2", + "3.32.3", + "3.32.4", + "3.32.5", + "3.32.6", + "3.32.7", + "4.0.0", + "4.0.1", + "4.0.10", + "4.0.11", + "4.0.12", + "4.0.2", + "4.0.3", + "4.0.4", + "4.0.5", + "4.0.6", + "4.0.7", + "4.0.8", + "4.0.9", + "4.1.0", + "4.1.1", + "4.1.2", + "4.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-567q-5qvw-pf92/GHSA-567q-5qvw-pf92.json", + "last_known_affected_version_range": "<= 4.2.0" + } + } + ], + "vulnerableFunction": "SoftFileLock marker open/stale breaking on Windows oplock", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/filelock/_soft.py", + "exists": true, + "sha256": "c9da56d79af78065b6901687863f05be7013430e7e91f5e7496c9885b11034a0", + "symbolMatches": [ + { + "line": 23, + "text": "class SoftFileLock(BaseFileLock):" + }, + { + "line": 43, + "text": " _lifetime_replacements: tuple[str, str] | None = (\"StrictSoftFileLock\", \"SoftFileLease\")" + }, + { + "line": 259, + "text": " \"SoftFileLock\"," + } + ] + }, + "actualCallPathAndUntrustedReachability": "Hub WeakFileLock fallback reaches SoftFileLock; filelock native lock can also fall back. Local user able to open cache marker can stall open beyond timeout. Cannot dismiss using HTTP request limits or parser child timeout.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Upgrade filelock4.2.1; qualify native/fallback lock contention, stale marker and finite timeout on Windows and Linux. Existing source checks do not prove ACL isolation.", + "disposition": "Fix available but blocked by compatibility", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Windows native and forced soft fallback; two contenders mutual exclusion; contention timeout; stale marker; local cache permissions. Linux flock/fallback and fresh Hugging Face cache in isolated development environment.", + "primarySources": [ + "https://github.com/advisories/GHSA-567q-5qvw-pf92", + "https://github.com/tox-dev/filelock", + "https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a", + "https://github.com/tox-dev/filelock/pull/835", + "https://github.com/tox-dev/filelock/releases/tag/4.2.1", + "https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92", + "https://osv.dev/vulnerability/GHSA-567q-5qvw-pf92" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-567q-5qvw-pf92", + "retrievedUtc": "2026-10-25T06:30:27.912117+00:00", + "status": 200, + "sha256": "9f5e5fb5809a74396ae2f41feb660b1c0558e30d42ab171e9f6ef03a28db6a13", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-567q-5qvw-pf92-osv-6ebd846f.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-567q-5qvw-pf92", + "retrievedUtc": "2026-10-25T06:30:27.943053+00:00", + "status": 200, + "sha256": "5eab7f91ea0e9c69e6fee5e71ca355a98a48255d2dacab1a0e8a9adc02ab6a26", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-567q-5qvw-pf92-92391304.raw" + }, + { + "url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92", + "retrievedUtc": "2026-10-25T06:30:28.060150+00:00", + "status": 200, + "sha256": "e4b4b71dd6e5442b13645b997eefa524882216ab5f63336ffb72ae0c5cf842f9", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2026-112907-vendor-b28d93bc.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.2.1" + ] + }, + { + "groupId": "CVE-2025-3001", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-3001", + "CVE-2025-3001", + "GHSA-qfhq-4f3w-5fph", + "PYSEC-2025-195" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-qfhq-4f3w-5fph", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-qfhq-4f3w-5fph/GHSA-qfhq-4f3w-5fph.json" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.10.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "torch" + }, + "vulnerable_version_range": "< 2.10.0", + "first_patched_version": "2.10.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-06-10T18:02:49Z", + "refreshedOsvId": "GHSA-qfhq-4f3w-5fph", + "refreshedOsvModified": "2026-06-10T18:26:26.736808954Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-qfhq-4f3w-5fph/GHSA-qfhq-4f3w-5fph.json" + } + } + ], + "vulnerableFunction": "torch.lstm_cell / native LSTM cell tensor validation", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/rnn.py", + "exists": true, + "sha256": "03e4ceec3ec84458937a5cd75da44fdaca2854b6592d354cf52d94705271bd23", + "symbolMatches": [ + { + "line": 300, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 390, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 1610, + "text": "class LSTMCell(RNNCellBase):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed LSTMCell forwards to _VF.lstm_cell. BART decoder uses attention, linear and layer norms, not recurrent LSTMCell. Request text becomes bounded token IDs, not arbitrary tensor dimensions or Python graphs.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "BART architecture excludes LSTM operation; native wheel and future architectures remain vulnerable until patched.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://github.com/advisories/GHSA-qfhq-4f3w-5fph", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-195.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/999d94b5ede5f4ec111ba7dd144129e2c2725b03", + "https://github.com/pytorch/pytorch/issues/149626", + "https://github.com/pytorch/pytorch/issues/149626#issue-2935860995", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3001", + "https://vuldb.com/?ctiid.302050", + "https://vuldb.com/?id.302050", + "https://vuldb.com/?submit.524212" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-qfhq-4f3w-5fph", + "retrievedUtc": "2026-10-25T06:30:28.074424+00:00", + "status": 200, + "sha256": "853f4249cfef409117fbcbcafeacab6570034687818209f52df9c0fb4992052b", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-qfhq-4f3w-5fph-osv-b148abe5.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-qfhq-4f3w-5fph", + "retrievedUtc": "2026-10-25T06:30:28.237497+00:00", + "status": 200, + "sha256": "dcdc862ca3f8d3a80d4a117707af694aba1636471f1f43b79c4a87e7789a9e1f", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-qfhq-4f3w-5fph-43ccbf76.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.10.0" + ] + }, + { + "groupId": "CVE-2025-3000", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-3000", + "CVE-2025-3000", + "GHSA-rrmf-rvhw-rf47", + "PYSEC-2025-194" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-rrmf-rvhw-rf47", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.13.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.10.0", + "2.11.0", + "2.12.0", + "2.12.1", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-rrmf-rvhw-rf47/GHSA-rrmf-rvhw-rf47.json", + "last_known_affected_version_range": "<= 2.12.1" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.13.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "torch" + }, + "vulnerable_version_range": "<= 2.12.1", + "first_patched_version": "2.13.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-07-17T17:05:49Z", + "refreshedOsvId": "GHSA-rrmf-rvhw-rf47", + "refreshedOsvModified": "2026-09-10T03:49:48.419046410Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.13.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.10.0", + "2.11.0", + "2.12.0", + "2.12.1", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-rrmf-rvhw-rf47/GHSA-rrmf-rvhw-rf47.json", + "last_known_affected_version_range": "<= 2.12.1" + } + } + ], + "vulnerableFunction": "torch.jit.script compilation", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/jit/_script.py", + "exists": true, + "sha256": "5dd7a014bb5943147e61a206f00b66936d94b468d4a7900f5391af44bcd1feb6", + "symbolMatches": [ + { + "line": 4, + "text": " - torch.jit.script" + }, + { + "line": 7, + "text": "functionalities in `torch.jit`." + }, + { + "line": 23, + "text": "from torch.jit._builtins import _register_builtin" + }, + { + "line": 24, + "text": "from torch.jit._fuser import _graph_for, _script_method_graph_for" + }, + { + "line": 25, + "text": "from torch.jit._monkeytype_config import (" + }, + { + "line": 30, + "text": "from torch.jit._recursive import (" + }, + { + "line": 36, + "text": "from torch.jit._state import (" + }, + { + "line": 43, + "text": "from torch.jit.frontend import get_default_args, get_jit_class_def, get_jit_def" + }, + { + "line": 65, + "text": "set_module(ScriptFunction, \"torch.jit\")" + }, + { + "line": 89, + "text": " `torch.jit.Attribute` should only be used in `__init__` method of `jit.ScriptModule`" + }, + { + "line": 109, + "text": " class AttributeModule(torch.jit.ScriptModule):" + }, + { + "line": 112, + "text": " self.foo = torch.jit.Attribute(0.1, float)" + }, + { + "line": 117, + "text": " self.names_ages = torch.jit.Attribute({}, Dict[str, int])" + }, + { + "line": 131, + "text": " Note: it's now preferred to instead use type annotations instead of `torch.jit.Attribute`:" + }, + { + "line": 320, + "text": " ] = torch.jit._recursive.create_script_module(" + }, + { + "line": 538, + "text": " # Unwrap torch.jit.Attribute into a regular setattr + record" + }, + { + "line": 611, + "text": " either :func:`tracing ` or :func:`scripting `." + }, + { + "line": 750, + "text": " See :func:`torch.jit.save ` which accepts a file-like object." + }, + { + "line": 849, + "text": " # s = torch.jit.script(...)" + }, + { + "line": 856, + "text": " return torch.jit._recursive.wrap_cpp_module(copy.copy(self._c))" + }, + { + "line": 859, + "text": " return torch.jit._recursive.wrap_cpp_module(copy.deepcopy(self._c, memo))" + }, + { + "line": 1099, + "text": " \"Use `with torch.jit.optimized_execution()` instead\"," + }, + { + "line": 1147, + "text": " return torch.jit._recursive.create_script_module(" + }, + { + "line": 1148, + "text": " obj, torch.jit._recursive.infer_methods_to_compile" + }, + { + "line": 1210, + "text": " # Allow torch.compile() to inline" + }, + { + "line": 1215, + "text": " return torch.jit._recursive.create_script_class(obj)" + }, + { + "line": 1218, + "text": "def script(" + }, + { + "line": 1237, + "text": " ``torch.jit.script`` can be used as a function for modules, functions, dictionaries and lists" + }, + { + "line": 1238, + "text": " and as a decorator ``@torch.jit.script`` for :ref:`torchscript-classes` and functions." + }, + { + "line": 1256, + "text": " The ``@torch.jit.script`` decorator will construct a :class:`ScriptFunction`" + }, + { + "line": 1265, + "text": " @torch.jit.script" + }, + { + "line": 1273, + "text": " print(type(foo)) # torch.jit.ScriptFunction" + }, + { + "line": 1299, + "text": " scripted_fn = torch.jit.script(test_sum, example_inputs=[(3, 4)])" + }, + { + "line": 1301, + "text": " print(type(scripted_fn)) # torch.jit.ScriptFunction" + }, + { + "line": 1344, + "text": " scripted_module = torch.jit.script(MyModule(2, 3))" + }, + { + "line": 1357, + "text": " # torch.jit.trace produces a ScriptModule's conv1 and conv2" + }, + { + "line": 1358, + "text": " self.conv1 = torch.jit.trace(nn.Conv2d(1, 20, 5), torch.rand(1, 1, 16, 16))" + }, + { + "line": 1359, + "text": " self.conv2 = torch.jit.trace(nn.Conv2d(20, 20, 5), torch.rand(1, 20, 16, 16))" + }, + { + "line": 1366, + "text": " scripted_module = torch.jit.script(MyModule())" + }, + { + "line": 1369, + "text": " the :func:`@torch.jit.export ` decorator to the method. To opt out of compilation" + }, + { + "line": 1370, + "text": " use :func:`@torch.jit.ignore ` or :func:`@torch.jit.unused `." + }, + { + "line": 1381, + "text": " @torch.jit.export" + }, + { + "line": 1385, + "text": " @torch.jit.ignore" + }, + { + "line": 1397, + "text": " scripted_module = torch.jit.script(MyModule())" + }, + { + "line": 1418, + "text": " scripted_model = torch.jit.script(pdt_model, example_inputs={pdt_model: [([10, 20, ], ), ], })" + }, + { + "line": 1452, + "text": " raise torch.jit.frontend.FrontendError(" + }, + { + "line": 1462, + "text": " overload_signature = torch.jit.annotations.get_signature(" + }, + { + "line": 1538, + "text": " @torch.jit.interface" + }, + { + "line": 1544, + "text": " @torch.jit.script" + }, + { + "line": 1554, + "text": " @torch.jit.export" + }, + { + "line": 1561, + "text": " user_fn_jit = torch.jit.script(user_fn)" + }, + { + "line": 1563, + "text": " impls = [Impl1(), torch.jit.script(Impl2())]" + }, + { + "line": 1608, + "text": "set_module(CompilationUnit, \"torch.jit\")" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Application does not call script or torch.compile; model loader creates Python BART class and generate uses eager no_grad. Text cannot submit Python source or choose a compiled graph. Third-party optional branches/native internals are not runtime qualified.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "2.13.0 is current published first patch; synthetic eager tests alone cannot prove selected checkpoint inference compatibility.", + "disposition": "Fix available but blocked by compatibility", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://github.com/advisories/GHSA-rrmf-rvhw-rf47", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-194.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/b90c94991cdf8b87c8f7439f79518e0ef2c4ca4f", + "https://github.com/pytorch/pytorch/issues/149623", + "https://github.com/pytorch/pytorch/issues/149623#issue-2935703015", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3000", + "https://vuldb.com/?ctiid.302049", + "https://vuldb.com/?id.302049", + "https://vuldb.com/?submit.524197" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-rrmf-rvhw-rf47", + "retrievedUtc": "2026-10-25T06:30:28.237497+00:00", + "status": 200, + "sha256": "90cab3a6f729723d1d9343a4be81c0c46efcc6702b8d76ca1c29e49fec3bdfe3", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-rrmf-rvhw-rf47-osv-ac409b50.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-rrmf-rvhw-rf47", + "retrievedUtc": "2026-10-25T06:30:28.270865+00:00", + "status": 200, + "sha256": "75028c655f1adff0a663ec51d1611e3c78391454ad7721b9590b8ad3de53fda6", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-rrmf-rvhw-rf47-4552267b.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.13.0" + ] + }, + { + "groupId": "CVE-2025-2999", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-2999", + "CVE-2025-2999", + "GHSA-vgrw-7cvw-pwgx", + "PYSEC-2025-193" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-vgrw-7cvw-pwgx", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vgrw-7cvw-pwgx/GHSA-vgrw-7cvw-pwgx.json" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.9.1" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "torch" + }, + "vulnerable_version_range": "< 2.9.1", + "first_patched_version": "2.9.1", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-06-10T17:25:21Z", + "refreshedOsvId": "GHSA-vgrw-7cvw-pwgx", + "refreshedOsvModified": "2026-06-10T17:41:15.774477397Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vgrw-7cvw-pwgx/GHSA-vgrw-7cvw-pwgx.json" + } + } + ], + "vulnerableFunction": "torch.nn.utils.rnn.unpack_sequence", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/utils/rnn.py", + "exists": true, + "sha256": "a476a6d965c1df34bef40f9b5d893d0d01057e88a3dc47b21f05a78ecab169ce", + "symbolMatches": [ + { + "line": 462, + "text": " if not (torch.jit.is_tracing() or torch.jit.is_scripting()):" + }, + { + "line": 574, + "text": "def unpack_sequence(packed_sequences: PackedSequence) -> List[Tensor]:" + } + ] + }, + "actualCallPathAndUntrustedReachability": "BART accepts padded input_ids plus attention_mask and does not construct PackedSequence or unpack_sequence; malicious tensor metadata is not an HTTP input.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Different RNN API; retain affected-package finding until patched or scoped owner decision.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://github.com/advisories/GHSA-vgrw-7cvw-pwgx", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-193.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd", + "https://github.com/pytorch/pytorch/issues/149622", + "https://github.com/pytorch/pytorch/issues/149622#issue-2935495265", + "https://nvd.nist.gov/vuln/detail/CVE-2025-2999", + "https://vuldb.com/?ctiid.302048", + "https://vuldb.com/?id.302048", + "https://vuldb.com/?submit.524198" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-vgrw-7cvw-pwgx", + "retrievedUtc": "2026-10-25T06:30:28.330804+00:00", + "status": 200, + "sha256": "8cc2cc67fcf447285a0bc46e2736a5265f7e43916255b0f01b1a8ce1a345ee13", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-vgrw-7cvw-pwgx-osv-e87f80e7.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-vgrw-7cvw-pwgx", + "retrievedUtc": "2026-10-25T06:30:28.354872+00:00", + "status": 200, + "sha256": "a01a8b1797c52b86855f7009669d89f83bbe3a9d75af309344088bc174a9bf6b", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-vgrw-7cvw-pwgx-66765d2e.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.9.1" + ] + }, + { + "groupId": "CVE-2025-2953", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-2953", + "CVE-2025-2953", + "GHSA-3749-ghw9-m3mg", + "PYSEC-2025-191" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-3749-ghw9-m3mg", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1-rc1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-3749-ghw9-m3mg/GHSA-3749-ghw9-m3mg.json" + } + } + ] + }, + { + "recordId": "PYSEC-2025-191", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.6.0+cu124" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-191.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.1-rc1" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "torch" + }, + "vulnerable_version_range": "< 2.7.1-rc1", + "first_patched_version": "2.7.1-rc1", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-06-08T19:50:13Z", + "refreshedOsvId": "GHSA-3749-ghw9-m3mg", + "refreshedOsvModified": "2026-09-10T03:50:22.781448235Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1-rc1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-3749-ghw9-m3mg/GHSA-3749-ghw9-m3mg.json" + } + } + ], + "vulnerableFunction": "torch.mkldnn_max_pool2d", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py", + "exists": true, + "sha256": "0af69ca566d95e20abf038761893b2c0b4daf349f45dc42469eba5a8151187ea", + "symbolMatches": [ + { + "line": 711, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 739, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 801, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 829, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 891, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 919, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 942, + "text": " default_size = torch.jit.annotate(List[int], [])" + }, + { + "line": 2684, + "text": " if not torch.jit.is_scripting() and input.dim() == 2 and input.is_nested:" + }, + { + "line": 2698, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 3015, + "text": "def ctc_loss(" + }, + { + "line": 4572, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 4617, + "text": " if not torch.jit.is_scripting() and torch._C._get_tracing_state():" + }, + { + "line": 4630, + "text": " elif torch.jit.is_scripting():" + }, + { + "line": 4683, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 5198, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 5393, + "text": " if torch.jit.is_scripting():" + }, + { + "line": 6339, + "text": " if not torch.jit.is_scripting() and not torch.jit.is_tracing():" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Vendor names mkldnn_max_pool2d. BART attention/linear architecture contains no image/max-pooling layer. Raw image bytes go to separate OCR parser; they are not passed as model tensor graphs.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "No selected BART max-pooling path identified; local arbitrary Python remains outside HTTP boundary.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://github.com/advisories/GHSA-3749-ghw9-m3mg", + "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-191.yaml", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models", + "https://github.com/pytorch/pytorch/issues/149274", + "https://github.com/pytorch/pytorch/issues/149274#issue-2923122269", + "https://nvd.nist.gov/vuln/detail/CVE-2025-2953", + "https://vuldb.com/?ctiid.302006", + "https://vuldb.com/?id.302006", + "https://vuldb.com/?submit.521279" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-3749-ghw9-m3mg", + "retrievedUtc": "2026-10-25T06:30:28.532169+00:00", + "status": 200, + "sha256": "5a0ee77481461a0d4a68623c9b3234013a9698ce5f6da6c2a5402f253b933414", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-3749-ghw9-m3mg-osv-e365bbf2.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-3749-ghw9-m3mg", + "retrievedUtc": "2026-10-25T06:30:28.598760+00:00", + "status": 200, + "sha256": "5064e931758c43cad1b021fa99d7d11ce5a0ca18a4ba05c3d0b0c4b9107bf9d2", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-3749-ghw9-m3mg-32a1d1f9.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.1-rc1" + ] + }, + { + "groupId": "CVE-2025-46148", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-46148", + "CVE-2025-46148", + "PYSEC-2025-198" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-198", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-198.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-198", + "refreshedOsvModified": "2026-05-20T09:19:19.437232Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-198.yaml" + } + } + ], + "vulnerableFunction": "nn.PairwiseDistance(p=2), eager/Inductor inconsistent result", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/distance.py", + "exists": true, + "sha256": "417ba188abd9341cf3af61065c3d5ce603f6667847e4486ec6da26e1112f6e8c", + "symbolMatches": [ + { + "line": 10, + "text": "class PairwiseDistance(Module):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed PairwiseDistance wrapper exists; BART/generate path does not compute pairwise distances. Vendor issue describes numeric correctness, not a demonstrated remotely supplied model graph.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Architectural separation reduces service exposure; provider range and severity retained without claiming native safety.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://gist.github.com/shaoyuyoung/65a587a579dfdff887b9b35bb79b9093", + "https://github.com/pytorch/pytorch/issues/151198", + "https://github.com/pytorch/pytorch/pull/152993" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-198", + "retrievedUtc": "2026-10-25T06:30:28.626582+00:00", + "status": 200, + "sha256": "97f1e0b35ae606db685bfcfc8ebdcbaf4a6625a8596e2485ab3d3d4f97950175", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-198-osv-0d0af086.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-46149", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-46149", + "CVE-2025-46149", + "PYSEC-2025-199" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-199", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-199.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-199", + "refreshedOsvModified": "2026-05-20T09:19:19.498677Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-199.yaml" + } + } + ], + "vulnerableFunction": "nn.Fold Inductor code generation assertion", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/fold.py", + "exists": true, + "sha256": "5e1cd90c0dbcca7dc56547ad9cadb0d158f73ff7d5d412091037241e97fbb8f2", + "symbolMatches": [ + { + "line": 11, + "text": "class Fold(Module):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Fold constructs image blocks; BART text inference has no Fold and does not call torch.compile or Inductor.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Requires a different operation and compiler route; preserve scanner finding until package patch.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://github.com/pytorch/pytorch/issues/147848", + "https://github.com/pytorch/pytorch/pull/147961" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-199", + "retrievedUtc": "2026-10-25T06:30:28.731589+00:00", + "status": 200, + "sha256": "b2c232b82b62338545418fca37206ef5474a87423abad2ccd498e1c62b15e7f3", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-199-osv-369f0d99.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-46150", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-46150", + "CVE-2025-46150", + "PYSEC-2025-200" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-200", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-200.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-200", + "refreshedOsvModified": "2026-05-20T09:19:19.559970Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-200.yaml" + } + } + ], + "vulnerableFunction": "FractionalMaxPool2d torch.compile correctness", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/pooling.py", + "exists": true, + "sha256": "75314d69b98088bc38f735df3e5fcdcfecf3cf69f77a1f5b5e504f05f74dbbbf", + "symbolMatches": [ + { + "line": 886, + "text": "class FractionalMaxPool2d(Module):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "No FractionalMaxPool2d in selected BART layers; application performs eager eval generation without compilation.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Model graph cannot be supplied through text; unqualified optional/native branches remain residual.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://github.com/pytorch/pytorch/issues/141538", + "https://github.com/pytorch/pytorch/issues/141538#issuecomment-2537424658", + "https://github.com/pytorch/pytorch/pull/144395" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-200", + "retrievedUtc": "2026-10-25T06:30:28.843533+00:00", + "status": 200, + "sha256": "5638f4b56e439a837c2c1f2085cfe7590335445e17189d2a9ea5168f4f713889", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-200-osv-ea7458fb.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-46152", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-46152", + "CVE-2025-46152", + "PYSEC-2025-201" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-201", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-201.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-201", + "refreshedOsvModified": "2026-05-20T09:19:19.618679Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-201.yaml" + } + } + ], + "vulnerableFunction": "bitwise_right_shift boundary shift in Inductor", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/_inductor/codegen/cpp.py", + "exists": true, + "sha256": "b6bc0add1b48dee08a5e486e47a6c06822a7ff78feee4aff498cc00226f5b0de", + "symbolMatches": [ + { + "line": 1972, + "text": " def load(self, name: str, index: sympy.Expr):" + }, + { + "line": 2580, + "text": " def load(self, name: str, index: sympy.Expr):" + }, + { + "line": 3264, + "text": " def load(self, name: str, index: sympy.Expr):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Vendor issue concerns compiled out-of-range shift count. Application accepts text, no arbitrary shift operand/compiler graph; selected BART layer source has no bitwise_right_shift.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Eager BART separation; not a claim that every installed tensor operation is fixed.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://github.com/pytorch/pytorch/issues/143555", + "https://github.com/pytorch/pytorch/pull/143635" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-201", + "retrievedUtc": "2026-10-25T06:30:29.012896+00:00", + "status": 200, + "sha256": "175b04732ffd82bd52db7edffee418f2816bd2db8736c86bc02901eb1082faab", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-201-osv-68fc374e.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-46153", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-46153", + "CVE-2025-46153", + "PYSEC-2025-202" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-202", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-202.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-202", + "refreshedOsvModified": "2026-05-20T09:19:19.678555Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.7.0" + } + ] + } + ], + "versions": [ + "2.6.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-202.yaml" + } + } + ], + "vulnerableFunction": "bernoulli_p decomposition, fallback_random, Dropout1d/2d/3d", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/_decomp/decompositions.py", + "exists": true, + "sha256": "182533b032c8024429e1109711ee64d2febf700efbc51b1795a1a666c688f05c", + "symbolMatches": [ + { + "line": 3370, + "text": "def lstm_cell(inp, hx, cx, hh_weight, hh_bias, hr_weight, chunk_dim):" + }, + { + "line": 5103, + "text": "def bernoulli(" + }, + { + "line": 5122, + "text": "def bernoulli_p(self, p, *, generator: Optional[torch.Generator] = None):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "BART contains functional.dropout, so merely saying no dropout would be false. model.eval() disables training dropout; app does not enable Inductor fallback_random nor spatial Dropout1d/2d/3d.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Vendor source points to Inductor fallback; old summary says before3.7.0 while range fixes2.7.0. Preserve discrepancy and use exact provider events, not guessed3.7 pin.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a", + "https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a", + "https://github.com/pytorch/pytorch/compare/v2.6.0...v2.7.0", + "https://github.com/pytorch/pytorch/issues/142853", + "https://github.com/pytorch/pytorch/pull/143460" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-202", + "retrievedUtc": "2026-10-25T06:30:29.027537+00:00", + "status": 200, + "sha256": "79e3804e6e9e0e5dde6d4d95f0a94371466612e0f345548703158da4f5a4066d", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-202-osv-e4ac46c7.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-55551", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-55551", + "CVE-2025-55551", + "PYSEC-2025-203" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-203", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-203.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.9.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-203", + "refreshedOsvModified": "2026-05-20T09:19:19.739357Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-203.yaml" + } + } + ], + "vulnerableFunction": "torch.linalg.lu with slicing in Inductor/AOT", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/linalg/__init__.py", + "exists": true, + "sha256": "e3947775231f6e130ea674d4f0458b1f40193b36ff064f15ecf9bdd914725cf8", + "symbolMatches": [ + { + "line": 2277, + "text": "This function computes a compact representation of the decomposition given by :func:`torch.linalg.lu`." + }, + { + "line": 2278, + "text": "If the matrix is square, this representation may be used in :func:`torch.linalg.lu_solve`" + }, + { + "line": 2296, + "text": ".. note:: {common_notes[\"sync_note_has_ex\"].format(\"torch.linalg.lu_factor_ex\")}" + }, + { + "line": 2309, + "text": " :func:`torch.linalg.lu_solve` solves a system of linear equations given the output of this" + }, + { + "line": 2315, + "text": " :func:`torch.linalg.lu` computes the LU decomposition with partial pivoting of a possibly" + }, + { + "line": 2341, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 2342, + "text": " >>> X1 = torch.linalg.lu_solve(LU, pivots, B1)" + }, + { + "line": 2343, + "text": " >>> X2 = torch.linalg.lu_solve(LU, pivots, B2)" + }, + { + "line": 2430, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 2432, + "text": " >>> X = torch.linalg.lu_solve(LU, pivots, B)" + }, + { + "line": 2437, + "text": " >>> X = torch.linalg.lu_solve(LU, pivots, B)" + }, + { + "line": 2442, + "text": " >>> X = torch.linalg.lu_solve(LU, pivots, B, left=False)" + }, + { + "line": 2447, + "text": " >>> X = torch.linalg.lu_solve(LU, pivots, B, adjoint=True)" + }, + { + "line": 2514, + "text": " >>> P, L, U = torch.linalg.lu(A)" + }, + { + "line": 2530, + "text": " >>> P, L, U = torch.linalg.lu(A, pivot=False)" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Vendor issue contrasts compiled/AOT and eager LU slicing. BART attention does not perform LU decomposition and application has no compile/AOT route.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Published range includes2.6 though issue title mentions2.8; no suppression solely from version in prose.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151401" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-203", + "retrievedUtc": "2026-10-25T06:30:29.137546+00:00", + "status": 200, + "sha256": "c2c7beb412daab91f878c04e3bcbb63a08c1cc829aa4db9b7d70629d98b043e8", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-203-osv-d375b122.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.9.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-55552", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-55552", + "CVE-2025-55552", + "PYSEC-2025-204" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-204", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-204.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.9.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-204", + "refreshedOsvModified": "2026-05-20T09:19:19.802802Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-204.yaml" + } + } + ], + "vulnerableFunction": "torch.rot90 and randn_like compiled graph", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py", + "exists": true, + "sha256": "d17ec7b319d124126f92b25faf3891e572bd924fa859f20a774cec81c89240c2", + "symbolMatches": [ + { + "line": 3253, + "text": " torch.cummin," + }, + { + "line": 3276, + "text": " >>> torch.cummin(a, dim=0)" + }, + { + "line": 6315, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 6324, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 6327, + "text": " >>> P_, L_, U_ = torch.linalg.lu(A)" + }, + { + "line": 6355, + "text": " :func:`torch.lu_solve` is deprecated in favor of :func:`torch.linalg.lu_solve`." + }, + { + "line": 6380, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 7868, + "text": " >>> s = torch.arange(16).reshape(2, 2, 2, 2).to_sparse(2)" + }, + { + "line": 7887, + "text": " torch.nan_to_num," + }, + { + "line": 7913, + "text": " >>> torch.nan_to_num(x)" + }, + { + "line": 7915, + "text": " >>> torch.nan_to_num(x, nan=2.0)" + }, + { + "line": 7917, + "text": " >>> torch.nan_to_num(x, nan=2.0, posinf=1.0)" + }, + { + "line": 11025, + "text": " torch.rot90," + }, + { + "line": 11043, + "text": " >>> torch.rot90(x, 1, [0, 1])" + }, + { + "line": 11054, + "text": " >>> torch.rot90(x, 1, [1, 2])" + } + ] + }, + "actualCallPathAndUntrustedReachability": "BART does not rotate image tensors or compile rot90/randn_like graphs. Text token IDs cannot select these APIs.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Vendor issue is compiler/eager mismatch; package severity remains source-reported.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/147847" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-204", + "retrievedUtc": "2026-10-25T06:30:29.334450+00:00", + "status": 200, + "sha256": "81e009c02ea5d5cc5452419b5a8058c0da4cc3a2fd9b33adf539f3d04d5013f0", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-204-osv-7d5305c0.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.9.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-55553", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-55553", + "CVE-2025-55553", + "PYSEC-2025-205" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-205", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-205.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.1" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-205", + "refreshedOsvModified": "2026-05-20T09:19:19.866970Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-205.yaml" + } + } + ], + "vulnerableFunction": "proxy_tensor.py tracing .random_ syntax error", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/fx/experimental/proxy_tensor.py", + "exists": true, + "sha256": "a3ea084b619a369620bdd3669247eaf75e85e8f1bd2a12b3bf01866151022553", + "symbolMatches": [ + { + "line": 141, + "text": " return eval(f\"lambda {argnames}: fn({argnames})\", {\"fn\": fn})" + }, + { + "line": 1631, + "text": " # a model that calls torch.compile (e.g when a model uses torch.cond.)" + }, + { + "line": 1754, + "text": " # When we call torch.compile inside HOO, we will end up" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Proxy tensor tracing/compiler route, not ordinary BART no_grad eager generation. Application exposes no graph tracing or caller-defined modules.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "No compiled tracing request boundary identified; changing execution mode needs new review.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151432", + "https://github.com/pytorch/pytorch/pull/154645" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-205", + "retrievedUtc": "2026-10-25T06:30:29.456688+00:00", + "status": 200, + "sha256": "ba0c8b7a82b9b00a5b642f99d476412d1f768a46bcf8e3568ff6467580de54d6", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-205-osv-27d07290.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.1" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-55554", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-55554", + "CVE-2025-55554", + "PYSEC-2025-206" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-206", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-206.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.9.0" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-206", + "refreshedOsvModified": "2026-05-20T09:19:19.928295Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-206.yaml" + } + } + ], + "vulnerableFunction": "torch.nan_to_num then long edge-case numeric conversion", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py", + "exists": true, + "sha256": "d17ec7b319d124126f92b25faf3891e572bd924fa859f20a774cec81c89240c2", + "symbolMatches": [ + { + "line": 3253, + "text": " torch.cummin," + }, + { + "line": 3276, + "text": " >>> torch.cummin(a, dim=0)" + }, + { + "line": 6315, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 6324, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 6327, + "text": " >>> P_, L_, U_ = torch.linalg.lu(A)" + }, + { + "line": 6355, + "text": " :func:`torch.lu_solve` is deprecated in favor of :func:`torch.linalg.lu_solve`." + }, + { + "line": 6380, + "text": " >>> LU, pivots = torch.linalg.lu_factor(A)" + }, + { + "line": 7868, + "text": " >>> s = torch.arange(16).reshape(2, 2, 2, 2).to_sparse(2)" + }, + { + "line": 7887, + "text": " torch.nan_to_num," + }, + { + "line": 7913, + "text": " >>> torch.nan_to_num(x)" + }, + { + "line": 7915, + "text": " >>> torch.nan_to_num(x, nan=2.0)" + }, + { + "line": 7917, + "text": " >>> torch.nan_to_num(x, nan=2.0, posinf=1.0)" + }, + { + "line": 11025, + "text": " torch.rot90," + }, + { + "line": 11043, + "text": " >>> torch.rot90(x, 1, [0, 1])" + }, + { + "line": 11054, + "text": " >>> torch.rot90(x, 1, [1, 2])" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Selected BART source has no nan_to_num().long() chain. Vendor issue remains open despite provider2.9.0 fix event; report does not infer closed/resolved from version metadata.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Provider patch claim conflicts with still-open vendor issue. Need fix-commit/reproducer confirmation before Fixed verified.", + "disposition": "Unresolved", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151510" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-206", + "retrievedUtc": "2026-10-25T06:30:29.565750+00:00", + "status": 200, + "sha256": "64f672cb98dbb7b9ef047f28dda45ac9a6c4336c8329dbf77b62dfbb172c4595", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-206-osv-50a92b9d.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.9.0" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-55557", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-55557", + "CVE-2025-55557", + "PYSEC-2025-207" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-207", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-207.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.1" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-207", + "refreshedOsvModified": "2026-05-20T09:19:19.989717Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-207.yaml" + } + } + ], + "vulnerableFunction": "Inductor compiled cummin Triton NameError", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py", + "exists": true, + "sha256": "e3e524e4c25b70412a9588e1a7af83c8538ee10057c50dde11863d270464f4ca", + "symbolMatches": [ + { + "line": 1887, + "text": " # if fallback_random, we allow not decomposing random" + }, + { + "line": 1889, + "text": " config.fallback_random" + }, + { + "line": 1982, + "text": " if config.fallback_random:" + }, + { + "line": 1992, + "text": "def bernoulli_(x, *args):" + }, + { + "line": 1993, + "text": " assert config.fallback_random or x.get_device() == torch.device(" + }, + { + "line": 1995, + "text": " ), \"this should be handled in decomps unless config.fallback_random or the device is CPU\"" + }, + { + "line": 2007, + "text": "def bernoulli_p(x, *args):" + }, + { + "line": 2008, + "text": " assert config.fallback_random or x.get_device() == torch.device(" + }, + { + "line": 2010, + "text": " ), \"this should be handled in decomps unless config.fallback_random or the device is CPU\"" + }, + { + "line": 2041, + "text": " elif config.fallback_random:" + }, + { + "line": 2051, + "text": " elif config.fallback_random:" + }, + { + "line": 2089, + "text": " assert not config.fallback_random" + }, + { + "line": 2119, + "text": " assert not config.fallback_random" + }, + { + "line": 3936, + "text": " def load(index):" + }, + { + "line": 4282, + "text": " def load(prefix, increments, start_indices, end_indices):" + }, + { + "line": 4579, + "text": " def load(prefix, i):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Selected BART attention and beam generation do not call compiled cummin; eager app supplies token text and uses CPU baseline rather than authored Triton kernels.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Architectural reduction only; CPU and CUDA selection still require candidate qualification.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151738", + "https://github.com/pytorch/pytorch/pull/151931" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-207", + "retrievedUtc": "2026-10-25T06:30:29.624998+00:00", + "status": 200, + "sha256": "a8cc18e20db1c0858ddcb453fa1b46c4040575420fa303a104cb968abe14dbe6", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-207-osv-564c9596.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.1" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-55558", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-55558", + "CVE-2025-55558", + "PYSEC-2025-208" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-208", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-208.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.1" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-208", + "refreshedOsvModified": "2026-05-20T09:19:20.054109Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-208.yaml" + } + } + ], + "vulnerableFunction": "Inductor Conv2d/hardshrink/view/mv compiler failure", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py", + "exists": true, + "sha256": "0af69ca566d95e20abf038761893b2c0b4daf349f45dc42469eba5a8151187ea", + "symbolMatches": [ + { + "line": 711, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 739, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 801, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 829, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 891, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 919, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 942, + "text": " default_size = torch.jit.annotate(List[int], [])" + }, + { + "line": 2684, + "text": " if not torch.jit.is_scripting() and input.dim() == 2 and input.is_nested:" + }, + { + "line": 2698, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 3015, + "text": "def ctc_loss(" + }, + { + "line": 4572, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 4617, + "text": " if not torch.jit.is_scripting() and torch._C._get_tracing_state():" + }, + { + "line": 4630, + "text": " elif torch.jit.is_scripting():" + }, + { + "line": 4683, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 5198, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 5393, + "text": " if torch.jit.is_scripting():" + }, + { + "line": 6339, + "text": " if not torch.jit.is_scripting() and not torch.jit.is_tracing():" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Vendor issue reports CppCompileError while scanner summary calls buffer overflow. BART is text attention/linear model, lacks this Conv2d/hardshrink chain, and app does not compile.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Retain source disagreement; no security downgrade justified merely by compiler error title.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151523", + "https://github.com/pytorch/pytorch/pull/151887" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-208", + "retrievedUtc": "2026-10-25T06:30:29.788910+00:00", + "status": 200, + "sha256": "f5563710cea47e063a4cea9fdc5cf99f5abcce1f79fab486761378f7f84fe365", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-208-osv-9e0d14c9.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.1" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-55560", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-55560", + "CVE-2025-55560", + "PYSEC-2025-209" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-209", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-209.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.7.1" + ], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-209", + "refreshedOsvModified": "2026-05-20T09:19:20.117285Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.1" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2025-209.yaml" + } + } + ], + "vulnerableFunction": "Inductor to_sparse/to_dense lowering", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py", + "exists": true, + "sha256": "e3e524e4c25b70412a9588e1a7af83c8538ee10057c50dde11863d270464f4ca", + "symbolMatches": [ + { + "line": 1887, + "text": " # if fallback_random, we allow not decomposing random" + }, + { + "line": 1889, + "text": " config.fallback_random" + }, + { + "line": 1982, + "text": " if config.fallback_random:" + }, + { + "line": 1992, + "text": "def bernoulli_(x, *args):" + }, + { + "line": 1993, + "text": " assert config.fallback_random or x.get_device() == torch.device(" + }, + { + "line": 1995, + "text": " ), \"this should be handled in decomps unless config.fallback_random or the device is CPU\"" + }, + { + "line": 2007, + "text": "def bernoulli_p(x, *args):" + }, + { + "line": 2008, + "text": " assert config.fallback_random or x.get_device() == torch.device(" + }, + { + "line": 2010, + "text": " ), \"this should be handled in decomps unless config.fallback_random or the device is CPU\"" + }, + { + "line": 2041, + "text": " elif config.fallback_random:" + }, + { + "line": 2051, + "text": " elif config.fallback_random:" + }, + { + "line": 2089, + "text": " assert not config.fallback_random" + }, + { + "line": 2119, + "text": " assert not config.fallback_random" + }, + { + "line": 3936, + "text": " def load(index):" + }, + { + "line": 4282, + "text": " def load(prefix, increments, start_indices, end_indices):" + }, + { + "line": 4579, + "text": " def load(prefix, i):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "BART does not create sparse model inputs and app does not enable Inductor. Sparse tensor graph cannot be submitted through summarize text.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Package remains affected according to provider; graph separation is a mitigation, not patch proof.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", + "https://github.com/pytorch/pytorch/issues/151522", + "https://github.com/pytorch/pytorch/pull/151897" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-209", + "retrievedUtc": "2026-10-25T06:30:29.872302+00:00", + "status": 200, + "sha256": "af52f8ae676c0cd6b18303419497ad8432ccbaf6d5fda3543289b4544ab1a6c0", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-209-osv-d1967f27.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.7.1" + ], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2026-4538", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2026-4538", + "CVE-2026-4538", + "PYSEC-2026-139" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2026-139", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.10.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2026-139.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2026-139", + "refreshedOsvModified": "2026-05-21T15:00:31.962442644Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.10.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2026-139.yaml" + } + } + ], + "vulnerableFunction": "torch.export.load .pt2 deserialization", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/export/__init__.py", + "exists": true, + "sha256": "6f66557c8689c3d3e2e1f6b951ed3c61649fb71914b2603ad5505831d7abbbc0", + "symbolMatches": [ + { + "line": 162, + "text": " if isinstance(mod, torch.jit.ScriptModule):" + }, + { + "line": 362, + "text": " if isinstance(mod, torch.jit.ScriptModule):" + }, + { + "line": 461, + "text": "def load(" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed export.load API exists but Transformers load_state_dict uses safetensors or torch.load, not export.load. Neither app nor parser accepts .pt2 or model uploads. Fixed repository alone does not establish checkpoint integrity.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "No published fixed release in baseline ranges. Vendor PR176791 closed without merged_at; proposal requires explicit weights_only=True and cannot establish released patch. No export.load in service path.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://github.com/pytorch/pytorch/", + "https://github.com/pytorch/pytorch/pull/176791", + "https://vuldb.com/?ctiid.352326", + "https://vuldb.com/?id.352326", + "https://vuldb.com/?submit.774681" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2026-139", + "retrievedUtc": "2026-10-25T06:30:29.927389+00:00", + "status": 200, + "sha256": "e67ea61edf63c4185e0bd1bbd16bfe0962a7c9197a538d5cb30a3c1a5513b194", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2026-139-osv-434604ef.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-3730", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2025-3730", + "CVE-2025-3730", + "GHSA-887c-mr87-cxwp", + "PYSEC-2026-1970" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-887c-mr87-cxwp", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1" + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.7.1", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-887c-mr87-cxwp/GHSA-887c-mr87-cxwp.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1970", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2026-1970.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.8.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "torch" + }, + "vulnerable_version_range": "<= 2.7.1", + "first_patched_version": "2.8.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-09-02T15:23:02Z", + "refreshedOsvId": "GHSA-887c-mr87-cxwp", + "refreshedOsvModified": "2026-09-10T03:50:23.660138570Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1" + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.7.1", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-887c-mr87-cxwp/GHSA-887c-mr87-cxwp.json" + } + } + ], + "vulnerableFunction": "torch.nn.functional.ctc_loss / native LossCTC", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py", + "exists": true, + "sha256": "0af69ca566d95e20abf038761893b2c0b4daf349f45dc42469eba5a8151187ea", + "symbolMatches": [ + { + "line": 711, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 739, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 801, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 829, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 891, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 919, + "text": " stride = torch.jit.annotate(List[int], [])" + }, + { + "line": 942, + "text": " default_size = torch.jit.annotate(List[int], [])" + }, + { + "line": 2684, + "text": " if not torch.jit.is_scripting() and input.dim() == 2 and input.is_nested:" + }, + { + "line": 2698, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 3015, + "text": "def ctc_loss(" + }, + { + "line": 4572, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 4617, + "text": " if not torch.jit.is_scripting() and torch._C._get_tracing_state():" + }, + { + "line": 4630, + "text": " elif torch.jit.is_scripting():" + }, + { + "line": 4683, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 5198, + "text": " if not torch.jit.is_scripting():" + }, + { + "line": 5393, + "text": " if torch.jit.is_scripting():" + }, + { + "line": 6339, + "text": " if not torch.jit.is_scripting() and not torch.jit.is_tracing():" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Vendor identifies CTC loss; service invokes BARTForConditionalGeneration.generate without labels, training or CTC. OCR uses Tesseract in parser child, not torch CTC.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Specific alternate loss API, not generic model-resource bug. No inference/native compatibility PASS asserted.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://github.com/advisories/GHSA-887c-mr87-cxwp", + "https://github.com/pytorch/pytorch", + "https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af", + "https://github.com/pytorch/pytorch/issues/150835", + "https://github.com/pytorch/pytorch/pull/150981", + "https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3730", + "https://pypi.org/project/torch", + "https://vuldb.com/?ctiid.305076", + "https://vuldb.com/?id.305076", + "https://vuldb.com/?submit.553645" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-887c-mr87-cxwp", + "retrievedUtc": "2026-10-25T06:30:30.077775+00:00", + "status": 200, + "sha256": "11247ca2d20a7f63f79f72ff2b975bce2814796de4ff0cef84b975956f6200fe", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-887c-mr87-cxwp-osv-10cb82eb.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-887c-mr87-cxwp", + "retrievedUtc": "2026-10-25T06:30:30.169953+00:00", + "status": 200, + "sha256": "66b6cefd2a5f23f39e8971e2e12157c1eed7098b608aedc35ec0ec29dbdf2d01", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-887c-mr87-cxwp-a22a6f54.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.8.0" + ] + }, + { + "groupId": "CVE-2026-24747", + "package": "torch", + "identifiers": [ + "BIT-pytorch-2026-24747", + "CVE-2026-24747", + "GHSA-63cw-57p8-fm3p", + "PYSEC-2026-1856", + "PYSEC-2026-2286" + ], + "baselineLockedVersion": "2.6.0+cpu", + "currentLockedVersionAtResearch": "2.6.0+cpu", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2026-2286", + "affected": [ + { + "package": { + "name": "torch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/torch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ], + "versions": [ + "1.0.0", + "1.0.1", + "1.1.0", + "1.10.0", + "1.10.1", + "1.10.2", + "1.11.0", + "1.12.0", + "1.12.1", + "1.13.0", + "1.13.1", + "1.2.0", + "1.3.0", + "1.3.1", + "1.4.0", + "1.5.0", + "1.5.1", + "1.6.0", + "1.7.0", + "1.7.1", + "1.8.0", + "1.8.1", + "1.9.0", + "1.9.1", + "2.0.0", + "2.0.1", + "2.1.0", + "2.1.1", + "2.1.2", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.3.1", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.7.1", + "2.8.0", + "2.9.0", + "2.9.1" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/torch/PYSEC-2026-2286.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "2.10.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "pytorch" + }, + "vulnerable_version_range": "< 2.10.0", + "first_patched_version": "2.10.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-01-29T03:42:53Z", + "refreshedOsvId": "GHSA-63cw-57p8-fm3p", + "refreshedOsvModified": "2026-07-13T07:26:23.701611780Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "pytorch", + "ecosystem": "PyPI", + "purl": "pkg:pypi/pytorch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ], + "versions": [ + "0.1.2", + "1.0.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-63cw-57p8-fm3p/GHSA-63cw-57p8-fm3p.json" + } + } + ], + "vulnerableFunction": "torch.load(weights_only=True) unpickler memory corruption", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py", + "exists": true, + "sha256": "977e5f089928f6a4dd4db0270e411c898921c7cd6ba6d12e1c3f88a1916c5820", + "symbolMatches": [ + { + "line": 479, + "text": " loader = safe_load_file if load_safe else partial(torch.load, map_location=\"cpu\", **weights_only_kwarg)" + }, + { + "line": 493, + "text": "def load_state_dict(" + }, + { + "line": 535, + "text": " return torch.load(" + }, + { + "line": 665, + "text": " def load(module: nn.Module, state_dict, prefix=\"\", assign_to_params_buffers=False):" + }, + { + "line": 1424, + "text": " if config._attn_implementation_internal is not None:" + }, + { + "line": 1427, + "text": " attn_implementation = config._attn_implementation_internal" + }, + { + "line": 1460, + "text": " def _autoset_attn_implementation(" + }, + { + "line": 1475, + "text": " # Here we use config._attn_implementation_internal to check whether the attention implementation was explicitely set by the user." + }, + { + "line": 1479, + "text": " if hasattr(config, \"_attn_implementation_internal\") and config._attn_implementation_internal is not None:" + }, + { + "line": 1501, + "text": " requested_attn_implementation = config._attn_implementation_internal" + }, + { + "line": 1516, + "text": " sub_config._attn_implementation_internal = curr_attn_implementation" + }, + { + "line": 2618, + "text": " def save_pretrained(" + }, + { + "line": 3151, + "text": " The model is set in evaluation mode by default using `model.eval()` (Dropout modules are deactivated). To train" + }, + { + "line": 4269, + "text": " model.eval()" + }, + { + "line": 5064, + "text": " if is_torch_fx_proxy(input_ids) or torch.jit.is_tracing() or is_torchdynamo_compiling():" + }, + { + "line": 5163, + "text": " \"\"\"Return a `torch.compile`'d version of `self.__call__`. This is useful to dynamically choose between" + }, + { + "line": 5174, + "text": " self._compiled_call = torch.compile(self.__call__, **compile_config.to_dict())" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Actual installed load_state_dict493 forwards non-safetensors checkpoints to torch.load535 with weights_only=True. app.from_pretrained does not require safetensors or pin revision; therefore malicious or compromised model/cache checkpoint can reach vulnerable loader even though no direct app torch.load exists.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Upgrade torch>=2.10 minimum for this issue; full published graph needs2.13.0. Require immutable revision, actual artifact format/hashes and benign inference. weights_only=True is not sufficient mitigation on2.6.", + "disposition": "Fix available but blocked by compatibility", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Model/checkpoint RCE boundary remains open.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "Candidate CPU wheel import on Windows and Linux3.12; local synthetic tensor generation; immutable selected checkpoint benign tokenizer/load/generate round trip, output shape/finite values, long/truncated input, resource limits. No malicious checkpoint execution; targeted upstream safe reproducer only if required.", + "primarySources": [ + "https://access.redhat.com/errata/RHSA-2026:24977", + "https://access.redhat.com/security/cve/CVE-2026-24747", + "https://bugzilla.redhat.com/show_bug.cgi?id=2433612", + "https://github.com/advisories/GHSA-63cw-57p8-fm3p", + "https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139", + "https://github.com/pytorch/pytorch/issues/163105", + "https://github.com/pytorch/pytorch/releases/tag/v2.10.0", + "https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p", + "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-63cw-57p8-fm3p", + "retrievedUtc": "2026-10-25T06:30:30.179374+00:00", + "status": 200, + "sha256": "7a75e04d5fb8e30c783f6ac6c6636ece21cadd98f7197dcdffb51abf4332b9e4", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-63cw-57p8-fm3p-osv-66e9e6d3.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-63cw-57p8-fm3p", + "retrievedUtc": "2026-10-25T06:30:30.231336+00:00", + "status": 200, + "sha256": "5bb5983e1e46a7025c3c750680f151e11f32c4b4c05ae9f609adb8db25a39efd", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-63cw-57p8-fm3p-82d6cacf.raw" + }, + { + "url": "https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p", + "retrievedUtc": "2026-10-25T06:30:30.264866+00:00", + "status": 200, + "sha256": "694d8a01acef02f621db0c4ba272e0a4342b72fa9463502820220e102893f4b1", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/BIT-pytorch-2026-24747-vendor-72668b06.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "2.10.0" + ] + }, + { + "groupId": "CVE-2025-14929", + "package": "transformers", + "identifiers": [ + "CVE-2025-14929", + "PYSEC-2025-217" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-217", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.0-rc0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-217.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-217", + "refreshedOsvModified": "2026-05-21T15:00:24.271970226Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.0-rc0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-217.yaml" + } + } + ], + "vulnerableFunction": "X-CLIP checkpoint conversion unsafe deserialization", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/x_clip/convert_x_clip_original_pytorch_to_hf.py", + "exists": false + }, + "actualCallPathAndUntrustedReachability": "Installed wheel contains no *convert* files under transformers/models. BART auto model selection does not run X-CLIP conversion CLI; service accepts no checkpoint conversion arguments.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Refreshed ZDI1144 still provides restriction mitigation, no patched version. Absent conversion script and fixed service route reduce exposure; no all-version package exemption.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-217", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1144/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-217", + "retrievedUtc": "2026-10-25T06:30:30.374924+00:00", + "status": 200, + "sha256": "3adf5df151de0a18f3feadfd2650ba305d3f237118ed1b132f2e842257b1e49d", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-217-osv-ff71c1e4.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1144/", + "retrievedUtc": "2026-10-25T06:30:30.509603+00:00", + "status": 200, + "sha256": "10b152510a354035579bbe5105a655b2d6ce68300b01b6986cf67713984d372d", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14929-vendor-4dd379a6.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-2099", + "package": "transformers", + "identifiers": [ + "CVE-2025-2099", + "GHSA-qq3j-4f4f-9583", + "PYSEC-2025-40" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-qq3j-4f4f-9583", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-qq3j-4f4f-9583/GHSA-qq3j-4f4f-9583.json" + } + } + ] + }, + { + "recordId": "PYSEC-2025-40", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "GIT", + "repo": "https://github.com/huggingface/transformers", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8cb522b4190bd556ce51be04942720650b1a3e57" + } + ] + }, + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.49.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "v4.49.0-AyaVision", + "v4.49.0-SigLIP-2", + "v4.49.0-SmolVLM-2", + "v4.33.1", + "v4.16.0", + "v4.15.0", + "v4.14.0", + "v4.13.0", + "v4.12.0", + "v4.11.0", + "v4.10.0", + "v4.9.0", + "v4.8.0", + "v4.7.0", + "v4.6.0", + "v4.5.0", + "v4.4.0", + "v4.3.0.rc1", + "4.3.0.rc1", + "v4.2.0", + "v4.1.1", + "v4.1.0", + "v3.5.0", + "v3.4.0", + "v3.3.1", + "v3.3.0", + "v3.2.0", + "v3.1.0", + "v3.0.2", + "v3.0.1", + "v3.0.0", + "v2.11.0", + "v2.10.0", + "v2.9.1", + "v2.9.0", + "v2.8.0", + "v2.7.0", + "v2.6.0", + "v2.5.1", + "v2.5.0", + "v2.4.1", + "v2.4.0", + "v2.3.0", + "v2.2.2", + "v2.2.1", + "v2.2.0", + "v2.1.1", + "v2.1.0", + "v2.0.0", + "1.2.0", + "1.1.0", + "1.0", + "v0.6.2", + "v0.6.1", + "v0.6.0", + "v0.5.1", + "v0.5.0", + "0.5.0", + "v0.4.0", + "v0.3.0", + "v0.2.0", + "v0.1.2", + "0.1.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-40.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.49.0", + "4.50.0", + "8cb522b4190bd556ce51be04942720650b1a3e57" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.50.0", + "first_patched_version": "4.50.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-09-25T21:06:40Z", + "refreshedOsvId": "GHSA-qq3j-4f4f-9583", + "refreshedOsvModified": "2025-09-25T21:51:20.118086Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-qq3j-4f4f-9583/GHSA-qq3j-4f4f-9583.json" + } + } + ], + "vulnerableFunction": "testing_utils.preprocess_string doctest ReDoS", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/testing_utils.py", + "exists": true, + "sha256": "d940c22683d702184e9685256d7994b47aaf84f8cdc30e62f94334fea69ddd7e", + "symbolMatches": [ + { + "line": 2593, + "text": "def preprocess_string(string, skip_cuda_tests):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed2593 preprocess_string processes Python/Markdown doctest contents. App tokenizer does not use testing_utils; CV text/Markdown uploads go through parser normalization, not doctest preparation.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Different function/input ownership; use4.50.0 current GHSA first patch rather than ambiguous prior4.49 event.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-qq3j-4f4f-9583", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57", + "https://github.com/huggingface/transformers/pull/36648", + "https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml", + "https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4", + "https://nvd.nist.gov/vuln/detail/CVE-2025-2099", + "https://osv.dev/vulnerability/GHSA-qq3j-4f4f-9583", + "https://osv.dev/vulnerability/PYSEC-2025-40" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-qq3j-4f4f-9583", + "retrievedUtc": "2026-10-25T06:30:30.512620+00:00", + "status": 200, + "sha256": "fd9177c8a24fe4c60895090a3d600ef819173aa70a67ac98abf86362ad48a4e3", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-qq3j-4f4f-9583-osv-280c35a2.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-qq3j-4f4f-9583", + "retrievedUtc": "2026-10-25T06:30:30.587961+00:00", + "status": 200, + "sha256": "c60c6fd46c713e9161da4a78a8f0a02d41abf09e0600746227ed8140bc866716", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-qq3j-4f4f-9583-971cd245.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.50.0" + ] + }, + { + "groupId": "CVE-2025-14926", + "package": "transformers", + "identifiers": [ + "CVE-2025-14926", + "PYSEC-2025-214" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-214", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-214.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-214", + "refreshedOsvModified": "2026-05-21T15:00:32.929011749Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-214.yaml" + } + } + ], + "vulnerableFunction": "SEW conversion convert_config string eval", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/sew/convert_sew_original_pytorch_checkpoint_to_pytorch.py", + "exists": false + }, + "actualCallPathAndUntrustedReachability": "Conversion script is absent from installed models tree; BART inference has no SEW conversion or checkpoint argument input.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "ZDI1147 refreshed report remains0-day with no release patch. Do not add conversion capability; arbitrary model files remain untrusted.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-214", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-214", + "retrievedUtc": "2026-10-25T06:30:30.673882+00:00", + "status": 200, + "sha256": "97107fe171dd25eab53fecd583360fe9ce08a47076accf5200e085abd645fde1", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-214-osv-b2482d71.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/", + "retrievedUtc": "2026-10-25T06:30:30.686526+00:00", + "status": 200, + "sha256": "6d707a24d8e132cf52688fedbc0b8b9e132cf5c6432e35e85ac3f2cb8563692f", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14926-vendor-445e796e.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-14930", + "package": "transformers", + "identifiers": [ + "CVE-2025-14930", + "PYSEC-2025-218" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-218", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-218.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-218", + "refreshedOsvModified": "2026-05-21T15:00:33.791364554Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-218.yaml" + } + } + ], + "vulnerableFunction": "GLM4 weights parsing unsafe deserialization", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/glm4", + "exists": false + }, + "actualCallPathAndUntrustedReachability": "No glm4 directory in installed4.48.3; selected mapping is BART, not GLM4. Advisory version range broader than named architecture availability; no assumption newest release fixes this.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "ZDI1145 still has no fixed version. Keep identity check for actual config; upgrading can introduce new architecture code.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-218", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-218", + "retrievedUtc": "2026-10-25T06:30:30.806213+00:00", + "status": 200, + "sha256": "ed2ea88b7e2a423d042ff44b2fc8678373c846ed89b52174d8f3a80001e30b6c", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-218-osv-b3d3148b.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/", + "retrievedUtc": "2026-10-25T06:30:30.977097+00:00", + "status": 200, + "sha256": "bd9c6966ace3e07e059e46e2e475d2a35e9b31b8d219692c1e8d25ca6ed3bbc9", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14930-vendor-174b1aa2.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-14920", + "package": "transformers", + "identifiers": [ + "CVE-2025-14920", + "PYSEC-2025-211" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-211", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.54.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-211.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-211", + "refreshedOsvModified": "2026-05-21T15:00:32.080516132Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.54.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-211.yaml" + } + } + ], + "vulnerableFunction": "Perceiver model conversion/deserialization", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/perceiver", + "exists": true, + "installedPythonFiles": [ + "configuration_perceiver.py", + "feature_extraction_perceiver.py", + "image_processing_perceiver.py", + "modeling_perceiver.py", + "tokenization_perceiver.py", + "__init__.py" + ] + }, + "actualCallPathAndUntrustedReachability": "Perceiver model package exists but no conversion scripts are installed. AutoModelForSeq2SeqLM maps bart to BartForConditionalGeneration; Perceiver has distinct model/configuration and tokenizer modules. No model upload endpoint.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "ZDI1150 no fix; actual Perceiver entry-point identity not published by ZDI beyond parsing. Treat family restriction as scoped mitigation rather than proven whole-package absence.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-211", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1150/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-211", + "retrievedUtc": "2026-10-25T06:30:30.981107+00:00", + "status": 200, + "sha256": "b1ad7651e401afe2f018a894233927f5e3ffc74713eff8c92f9b67010506c915", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-211-osv-46b72aed.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1150/", + "retrievedUtc": "2026-10-25T06:30:31.016057+00:00", + "status": 200, + "sha256": "29ee25a4f04f0c1dcd8f7c8d726f0709a189ce4fc685f0e69dff0a581f740795", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14920-vendor-0db1197c.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-14921", + "package": "transformers", + "identifiers": [ + "CVE-2025-14921", + "PYSEC-2025-212" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-212", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.54.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-212.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-212", + "refreshedOsvModified": "2026-05-21T15:00:32.052313357Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.54.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-212.yaml" + } + } + ], + "vulnerableFunction": "Transformer-XL tokenizer/model pickle deserialization", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py", + "exists": true, + "sha256": "7748107f885bd05feca36e23292277acb8a9d6d55dc046035ed6be89cc8ab95b", + "symbolMatches": [ + { + "line": 174, + "text": " \"`TransfoXL` was deprecated due to security issues linked to `pickle.load` in `TransfoXLTokenizer`. \"" + }, + { + "line": 206, + "text": " \"This part uses `pickle.load` which is insecure and will execute arbitrary code that is \"" + }, + { + "line": 213, + "text": " vocab_dict = pickle.load(f)" + }, + { + "line": 225, + "text": " vocab_dict = torch.load(pretrained_vocab_file, weights_only=True)" + }, + { + "line": 708, + "text": " corpus_dict = torch.load(resolved_corpus_file, weights_only=True)" + }, + { + "line": 787, + "text": " corpus = torch.load(fn_pickle, weights_only=True)" + }, + { + "line": 792, + "text": " \"This part uses `pickle.load` which is insecure and will execute arbitrary code that is potentially \"" + }, + { + "line": 798, + "text": " corpus = pickle.load(fp)" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed TransfoXL tokenizer explicitly contains pickle.load and warns/deprecates unsafe loading. BartTokenizer/BartTokenizerFast map uses JSON vocab/merges and byte BPE; no Transformer-XL vocab accepted by service.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "ZDI1149 no fixed release; dangerous API does exist. Architecture selection and no vocab upload reduce reachability; trust actual config identity before stronger verdict.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-212", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1149/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-212", + "retrievedUtc": "2026-10-25T06:30:31.278789+00:00", + "status": 200, + "sha256": "4ddc0cacf64df0a185a7f9ed7efd8ab925f47415e7a5d16ef6c0cfe46f39c175", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-212-osv-46f45372.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1149/", + "retrievedUtc": "2026-10-25T06:30:31.328648+00:00", + "status": 200, + "sha256": "ad3fe799fe57f7ca2c4f6801b73909ad04f6e18df1605f414e29072c99bfa69c", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14921-vendor-f87260aa.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-14924", + "package": "transformers", + "identifiers": [ + "CVE-2025-14924", + "PYSEC-2025-213" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-213", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.55.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-213.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-213", + "refreshedOsvModified": "2026-05-21T15:00:32.048516839Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.55.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-213.yaml" + } + } + ], + "vulnerableFunction": "megatron_gpt2 checkpoint conversion deserialization", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/megatron_gpt2/convert_megatron_gpt2_checkpoint.py", + "exists": false + }, + "actualCallPathAndUntrustedReachability": "Conversion scripts absent in installed models tree; selected BART loader uses standard load_state_dict, not Megatron conversion. General torch.load checkpoint risk tracked separately under24747.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "ZDI1141 says vendor declined changes; no patched version. Do not treat newer Transformers as closing this record without evidence.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-213", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1141/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-213", + "retrievedUtc": "2026-10-25T06:30:31.559012+00:00", + "status": 200, + "sha256": "0ba1b14fb5c727d9941c5df62d97d5cb8a7407e0af2fcc7e8bad140d2a945f6f", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-213-osv-e1a15253.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1141/", + "retrievedUtc": "2026-10-25T06:30:31.849765+00:00", + "status": 200, + "sha256": "14c885de463b5256fb9045a97c1025b906961eeedd8006043fcded26a1f5d25e", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14924-vendor-6bff1021.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-14927", + "package": "transformers", + "identifiers": [ + "CVE-2025-14927", + "PYSEC-2025-215" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-215", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-215.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-215", + "refreshedOsvModified": "2026-05-21T15:00:32.888290877Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-215.yaml" + } + } + ], + "vulnerableFunction": "SEW-D convert_config eval", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/sew_d/convert_sew_d_original_pytorch_checkpoint_to_pytorch.py", + "exists": false + }, + "actualCallPathAndUntrustedReachability": "SEW-D conversion source absent from installed wheel. HTTP summarize does not expose conversion/config strings or select audio model families.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "ZDI1148 no fix; fixed model family is mitigation, not universal library safety.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-215", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-215", + "retrievedUtc": "2026-10-25T06:30:32.212243+00:00", + "status": 200, + "sha256": "2980168df942462a444385ba8b6fedb3a98ccd7b1173fd0b8ab0bdc49e70f3ea", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-215-osv-5acad121.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/", + "retrievedUtc": "2026-10-25T06:30:32.407304+00:00", + "status": 200, + "sha256": "ff54a2f77f12e400ef72769849797a9300c0d2e54520bdbbf26430bab9c78fec", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14927-vendor-a5b776ab.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-14928", + "package": "transformers", + "identifiers": [ + "CVE-2025-14928", + "PYSEC-2025-216" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "PYSEC-2025-216", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-216.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [], + "refreshedGithubVulnerabilities": [], + "refreshedGithubUpdatedAt": null, + "refreshedOsvId": "PYSEC-2025-216", + "refreshedOsvModified": "2026-05-21T15:00:32.939311939Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.57.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2025-216.yaml" + } + } + ], + "vulnerableFunction": "HuBERT convert_config eval", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/hubert/convert_hubert_original_pytorch_checkpoint_to_pytorch.py", + "exists": false + }, + "actualCallPathAndUntrustedReachability": "HuBERT conversion source absent from installed wheel; BART tokenizer/model path does not invoke audio conversion.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "ZDI1146 no release patch. Retain record rather than infer upgrade clears it.", + "disposition": "No fix", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://osv.dev/vulnerability/PYSEC-2025-216", + "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-216", + "retrievedUtc": "2026-10-25T06:30:32.498018+00:00", + "status": 200, + "sha256": "260b9ce87788db46ff1336dc4ae59474da75dbd673c5ca779ef20487d22123bb", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-216-osv-a41da499.raw" + }, + { + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/", + "retrievedUtc": "2026-10-25T06:30:32.737570+00:00", + "status": 200, + "sha256": "5baa635ef760b47a023eb0332811f4b041403bac722c7d4202a59cd8c9c9c4de", + "contentType": "text/html; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14928-vendor-f5b408f5.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [], + "fixEvidenceLimit": "No fresh range in vendor issue/ZDI page. Existing provider events preserved; issue closure or newest release is not patch verification." + }, + { + "groupId": "CVE-2025-3933", + "package": "transformers", + "identifiers": [ + "CVE-2025-3933", + "GHSA-37mw-44qp-f5jm", + "PYSEC-2026-1977" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-37mw-44qp-f5jm", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.51.3", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-37mw-44qp-f5jm/GHSA-37mw-44qp-f5jm.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1977", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1977.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.52.1" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "<= 4.51.3", + "first_patched_version": "4.52.1", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-08-07T14:55:34Z", + "refreshedOsvId": "GHSA-37mw-44qp-f5jm", + "refreshedOsvModified": "2026-09-10T03:50:57.888142744Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.51.3", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-37mw-44qp-f5jm/GHSA-37mw-44qp-f5jm.json" + } + } + ], + "vulnerableFunction": "DonutProcessor.token2json ReDoS", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/donut/processing_donut.py", + "exists": true, + "sha256": "d06b6c88e577debc28b6aa73a137b708d4a0ab3e2476525bfb7b77a9dff5f419", + "symbolMatches": [ + { + "line": 160, + "text": " def token2json(self, tokens, is_inner_value=False, added_vocab=None):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Actual Donut token2json regex exists in separate processor. Service document OCR invokes Tesseract/Pillow, never DonutProcessor; BART decode returns text without token2json.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Explicit different document-processing owner avoids confusing OCR with Donut; installed affected API remains.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-37mw-44qp-f5jm", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93", + "https://github.com/huggingface/transformers/pull/37788", + "https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3933", + "https://osv.dev/vulnerability/GHSA-37mw-44qp-f5jm", + "https://osv.dev/vulnerability/PYSEC-2026-1977", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-37mw-44qp-f5jm", + "retrievedUtc": "2026-10-25T06:30:32.752129+00:00", + "status": 200, + "sha256": "376b41215eab57be6199b79ed664122fe1aca902d80f2c76a66fdbd63960f897", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-37mw-44qp-f5jm-osv-0441df11.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-37mw-44qp-f5jm", + "retrievedUtc": "2026-10-25T06:30:32.792453+00:00", + "status": 200, + "sha256": "74c651bebaef86129dabeabf2b262f8f1b6519345d0a715dc2a3e8d6fa58ad34", + "contentType": "application/json; charset=utf-8", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-37mw-44qp-f5jm-18bd3e7d.raw" + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.52.1" + ] + }, + { + "groupId": "CVE-2025-6638", + "package": "transformers", + "identifiers": [ + "CVE-2025-6638", + "GHSA-59p9-h35m-wg4g", + "PYSEC-2026-1981" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-59p9-h35m-wg4g", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-59p9-h35m-wg4g/GHSA-59p9-h35m-wg4g.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1981", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1981.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.53.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.53.0", + "first_patched_version": "4.53.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-09-15T13:59:14Z", + "refreshedOsvId": "GHSA-59p9-h35m-wg4g", + "refreshedOsvModified": "2026-09-10T03:50:58.113501288Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-59p9-h35m-wg4g/GHSA-59p9-h35m-wg4g.json" + } + } + ], + "vulnerableFunction": "MarianTokenizer.remove_language_code ReDoS", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/marian/tokenization_marian.py", + "exists": true, + "sha256": "b8cfb52a667f597c9e304197bb3df3a1bb0eb6130f301df60d485cb1cea1f92a", + "symbolMatches": [ + { + "line": 185, + "text": " def remove_language_code(self, text: str):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Marian tokenizer removes language codes; BART maps to BartTokenizer/Fast with separate vocab/merges byte BPE. Request text cannot select Marian tokenizer.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Architecture-specific tokenizer; validate actual model/tokenizer config before full Not affected claim.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-59p9-h35m-wg4g", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be", + "https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099", + "https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36", + "https://nvd.nist.gov/vuln/detail/CVE-2025-6638", + "https://osv.dev/vulnerability/GHSA-59p9-h35m-wg4g", + "https://osv.dev/vulnerability/PYSEC-2026-1981", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-59p9-h35m-wg4g", + "retrievedUtc": "2026-10-25T06:30:33.032679+00:00", + "status": 200, + "sha256": "7cbcce5361b161ed5765896b91fd368cbcdf651aa006d54adbbf647ef8511397", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-59p9-h35m-wg4g-osv-590f4b02.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-59p9-h35m-wg4g", + "retrievedUtc": "2026-10-25T06:30:33.041743+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-59p9-h35m-wg4g-11c0ccd8.raw", + "sha256": "0e840e5ba05b15a23aa0799d707eef882e66734b7de31895673e73e5c3521382", + "capturedFileMtimeUtc": "2026-10-25T06:24:01.529227+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.53.0" + ] + }, + { + "groupId": "CVE-2025-3264", + "package": "transformers", + "identifiers": [ + "CVE-2025-3264", + "GHSA-jjph-296x-mrcr", + "PYSEC-2026-1985" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-jjph-296x-mrcr", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-jjph-296x-mrcr/GHSA-jjph-296x-mrcr.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1985", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1985.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.51.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.51.0", + "first_patched_version": "4.51.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-07-08T16:38:04Z", + "refreshedOsvId": "GHSA-jjph-296x-mrcr", + "refreshedOsvModified": "2026-07-07T17:56:51.899728258Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-jjph-296x-mrcr/GHSA-jjph-296x-mrcr.json" + } + } + ], + "vulnerableFunction": "dynamic_module_utils.get_imports Python-source regex", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/dynamic_module_utils.py", + "exists": true, + "sha256": "0e108a285459932569a86623fbd764f1266abc31ead4a5b7ee9967507bd684d2", + "symbolMatches": [ + { + "line": 141, + "text": "def get_imports(filename: Union[str, os.PathLike]) -> List[str]:" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed141 get_imports reads Python code. Auto factory540 executes dynamic module path only for has_remote_code and resolved trust_remote_code. Current app does not opt in, BART has local implementation; missing immutable artifact/config identity prevents universal dispatch proof.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Fix4.51.0; upgrade candidate5.10.0. Explicitly deny remote code and qualify loader; do not conflate regex input with ordinary request text.", + "disposition": "Fix available but blocked by compatibility", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-jjph-296x-mrcr", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76", + "https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca", + "https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3264", + "https://osv.dev/vulnerability/GHSA-jjph-296x-mrcr", + "https://osv.dev/vulnerability/PYSEC-2026-1985", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-jjph-296x-mrcr", + "retrievedUtc": "2026-10-25T06:30:33.150072+00:00", + "status": 200, + "sha256": "495e3ed8d1f742310a4bf989527c641c86156896e320eed71bb5cc53989a64a5", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-jjph-296x-mrcr-osv-ae7db71a.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-jjph-296x-mrcr", + "retrievedUtc": "2026-10-25T06:30:33.224644+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-jjph-296x-mrcr-8f7b1a40.raw", + "sha256": "3bdc937352b567bca39c9507d590cf53836ae610a1538a4f9533c2c9d22caf37", + "capturedFileMtimeUtc": "2026-10-25T06:24:01.829961+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.51.0" + ] + }, + { + "groupId": "CVE-2025-1194", + "package": "transformers", + "identifiers": [ + "CVE-2025-1194", + "GHSA-fpwr-67px-3qhx", + "PYSEC-2026-1984" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-fpwr-67px-3qhx", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-fpwr-67px-3qhx/GHSA-fpwr-67px-3qhx.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1984", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1984.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.50.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.50.0", + "first_patched_version": "4.50.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-08-04T15:27:21Z", + "refreshedOsvId": "GHSA-fpwr-67px-3qhx", + "refreshedOsvModified": "2026-08-13T20:11:58.399313771Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.50.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-fpwr-67px-3qhx/GHSA-fpwr-67px-3qhx.json" + } + } + ], + "vulnerableFunction": "SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoS", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py", + "exists": true, + "sha256": "843fc64c5b7438d2409a2fe17b3f1578786500b3cee6d8155201c0485003ae0b", + "symbolMatches": [ + { + "line": 195, + "text": "class SubWordJapaneseTokenizer:" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Named GPT-NeoX-Japanese tokenizer exists as separate implementation; selected BART tokenizer uses byte BPE, not SubWordJapaneseTokenizer. Text cannot select tokenizer class directly.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Do not label all tokenization ReDoS reachable merely because service tokenizes; actual family/config still needs identity.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-fpwr-67px-3qhx", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815", + "https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2", + "https://nvd.nist.gov/vuln/detail/CVE-2025-1194", + "https://osv.dev/vulnerability/GHSA-fpwr-67px-3qhx", + "https://osv.dev/vulnerability/PYSEC-2026-1984", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-fpwr-67px-3qhx", + "retrievedUtc": "2026-10-25T06:30:33.336387+00:00", + "status": 200, + "sha256": "ff7aa3d63f27c4509c92eaf128fe7fe67ce22f5f352fd4b6dab63a10ef65cf38", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-fpwr-67px-3qhx-osv-f31f72d6.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-fpwr-67px-3qhx", + "retrievedUtc": "2026-10-25T06:30:33.348683+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-fpwr-67px-3qhx-4939b48c.raw", + "sha256": "607b8ce15bb158cfcc2c2c081270c57ddafbfa5cc13fe797a6dc08776121a454", + "capturedFileMtimeUtc": "2026-10-25T06:24:01.884250+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.50.0" + ] + }, + { + "groupId": "CVE-2025-3777", + "package": "transformers", + "identifiers": [ + "CVE-2025-3777", + "GHSA-phhr-52qp-3mj4", + "PYSEC-2026-1986" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "LOW" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-phhr-52qp-3mj4", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-phhr-52qp-3mj4/GHSA-phhr-52qp-3mj4.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1986", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1986.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.52.1" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.52.1", + "first_patched_version": "4.52.1", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-07-08T16:46:55Z", + "refreshedOsvId": "GHSA-phhr-52qp-3mj4", + "refreshedOsvModified": "2026-09-10T03:50:26.198077196Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.52.1" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-phhr-52qp-3mj4/GHSA-phhr-52qp-3mj4.json" + } + } + ], + "vulnerableFunction": "image_utils video URL username validation", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/image_utils.py", + "exists": true, + "sha256": "9e7f9840d8975a599c1db67743f0cfec3abd36e206fc060f11e4d2054723bdb7" + }, + "actualCallPathAndUntrustedReachability": "Installed4.48.3 image_utils has load_image (HTTP image URL) but no load_video/YouTube helper; video_utils.py is absent. BART receives text only; uploaded image bytes handled by PIL/Tesseract in parser, never a Transformers media URL helper.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "No Transformers video/YouTube URL input route. CV text containing a URL is text, not automatically dereferenced by this helper.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-phhr-52qp-3mj4", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/blame/a7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4/src/transformers/image_utils.py", + "https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082", + "https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3777", + "https://osv.dev/vulnerability/GHSA-phhr-52qp-3mj4", + "https://osv.dev/vulnerability/PYSEC-2026-1986", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-phhr-52qp-3mj4", + "retrievedUtc": "2026-10-25T06:30:33.452192+00:00", + "status": 200, + "sha256": "1e689ca22b5710c8c957578ee80b3d1f36bf22cd435c67d666c9c66dfeb3d2c9", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-phhr-52qp-3mj4-osv-46a5e327.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-phhr-52qp-3mj4", + "retrievedUtc": "2026-10-25T06:30:33.453182+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-phhr-52qp-3mj4-99448577.raw", + "sha256": "270ec206a7464d9f0b2acb19b37bc3bc7821b1a19682ac02e8255ed6247d17b0", + "capturedFileMtimeUtc": "2026-10-25T06:24:01.984456+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.52.1" + ] + }, + { + "groupId": "CVE-2025-6051", + "package": "transformers", + "identifiers": [ + "CVE-2025-6051", + "GHSA-rcv9-qm8p-9p6j", + "PYSEC-2026-1988" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-rcv9-qm8p-9p6j", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-rcv9-qm8p-9p6j/GHSA-rcv9-qm8p-9p6j.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1988", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1988.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.53.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.53.0", + "first_patched_version": "4.53.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-09-15T20:31:49Z", + "refreshedOsvId": "GHSA-rcv9-qm8p-9p6j", + "refreshedOsvModified": "2026-09-10T03:50:28.694224028Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-rcv9-qm8p-9p6j/GHSA-rcv9-qm8p-9p6j.json" + } + } + ], + "vulnerableFunction": "CLVP EnglishNormalizer.normalize_numbers ReDoS", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/clvp/number_normalizer.py", + "exists": true, + "sha256": "956d4c8d163c3c30168d62c0f92d8593e2d559aaa4981542002985dbbeb9569b", + "symbolMatches": [ + { + "line": 197, + "text": " def normalize_numbers(self, text: str) -> str:" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Actual normalize_numbers197 is CLVP text/audio normalizer; selected BART tokenizer has no EnglishNormalizer call. This is not generic normalize_text in parser_child.py.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Keep distinct normalization owners and architecture scopes; model identity qualification remains needed.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-rcv9-qm8p-9p6j", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216", + "https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0", + "https://github.com/huggingface/transformers/pull/38844", + "https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d", + "https://nvd.nist.gov/vuln/detail/CVE-2025-6051", + "https://osv.dev/vulnerability/GHSA-rcv9-qm8p-9p6j", + "https://osv.dev/vulnerability/PYSEC-2026-1988", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-rcv9-qm8p-9p6j", + "retrievedUtc": "2026-10-25T06:30:33.556477+00:00", + "status": 200, + "sha256": "87ea9d51167355578662a4c99ac8278c64c7399412d6aeb2b7542fb18427eb61", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-rcv9-qm8p-9p6j-osv-daad42d3.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-rcv9-qm8p-9p6j", + "retrievedUtc": "2026-10-25T06:30:33.557988+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-rcv9-qm8p-9p6j-97db1314.raw", + "sha256": "c1a8867785237a3723111fa39f3c7e5180fd11c1e1dfe41e2bed77e2f30c4e5a", + "capturedFileMtimeUtc": "2026-10-25T06:24:01.944553+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.53.0" + ] + }, + { + "groupId": "CVE-2025-6921", + "package": "transformers", + "identifiers": [ + "CVE-2025-6921", + "GHSA-4w7r-h757-3r74", + "PYSEC-2026-1980" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-4w7r-h757-3r74", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-4w7r-h757-3r74/GHSA-4w7r-h757-3r74.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1980", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1980.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.53.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.53.0", + "first_patched_version": "4.53.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-09-23T17:37:49Z", + "refreshedOsvId": "GHSA-4w7r-h757-3r74", + "refreshedOsvModified": "2026-09-10T03:50:27.867584538Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-4w7r-h757-3r74/GHSA-4w7r-h757-3r74.json" + } + } + ], + "vulnerableFunction": "AdamWeightDecay._do_use_weight_decay user regex", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/optimization_tf.py", + "exists": true, + "sha256": "50fb5b6de47ffd9a0f1bb7810f95cc0418987e301947c6b92f6cd626c08b2fff", + "symbolMatches": [ + { + "line": 292, + "text": " def _do_use_weight_decay(self, param_name):" + } + ] + }, + "actualCallPathAndUntrustedReachability": "TensorFlow training optimizer branch. Service performs torch.no_grad model.eval generation; no optimizer, training patterns or TensorFlow model conversion requested.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "No optimizer input boundary or training invocation; tensor generation length controls do not constitute the mitigation.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-4w7r-h757-3r74", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be", + "https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099", + "https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f", + "https://nvd.nist.gov/vuln/detail/CVE-2025-6921", + "https://osv.dev/vulnerability/GHSA-4w7r-h757-3r74", + "https://osv.dev/vulnerability/PYSEC-2026-1980", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-4w7r-h757-3r74", + "retrievedUtc": "2026-10-25T06:30:33.644447+00:00", + "status": 200, + "sha256": "c05b4f254b73e97e9b7af0ebacc3115118e0650a8f3a66578591606ea2715479", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-4w7r-h757-3r74-osv-4c08eb78.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-4w7r-h757-3r74", + "retrievedUtc": "2026-10-25T06:30:33.690314+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-4w7r-h757-3r74-c758772c.raw", + "sha256": "cf4130ef6e6affd435a9b5cf7cb61486ea3e9dad9788748e0d45a756022e0e13", + "capturedFileMtimeUtc": "2026-10-25T06:24:02.270816+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.53.0" + ] + }, + { + "groupId": "CVE-2025-3263", + "package": "transformers", + "identifiers": [ + "CVE-2025-3263", + "GHSA-q2wp-rjmx-x6x9", + "PYSEC-2026-1987" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-q2wp-rjmx-x6x9", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-q2wp-rjmx-x6x9/GHSA-q2wp-rjmx-x6x9.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1987", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1987.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.51.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.51.0", + "first_patched_version": "4.51.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-07-08T16:33:28Z", + "refreshedOsvId": "GHSA-q2wp-rjmx-x6x9", + "refreshedOsvModified": "2026-07-07T17:56:57.889099913Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.51.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-q2wp-rjmx-x6x9/GHSA-q2wp-rjmx-x6x9.json" + } + } + ], + "vulnerableFunction": "configuration_utils.get_configuration_file ReDoS", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/configuration_utils.py", + "exists": true, + "sha256": "928b493592af43ff930cfbcd63619f93cd09ce522ca9482a54bd11a7a8fce825", + "symbolMatches": [ + { + "line": 304, + "text": " self._attn_implementation_internal = kwargs.pop(\"attn_implementation\", None)" + }, + { + "line": 358, + "text": " if hasattr(self, \"_attn_implementation_internal\"):" + }, + { + "line": 359, + "text": " if self._attn_implementation_internal is None:" + }, + { + "line": 363, + "text": " return self._attn_implementation_internal" + }, + { + "line": 369, + "text": " self._attn_implementation_internal = value" + }, + { + "line": 371, + "text": " def save_pretrained(self, save_directory: Union[str, os.PathLike], push_to_hub: bool = False, **kwargs):" + }, + { + "line": 858, + "text": " if \"_attn_implementation_internal\" in serializable_config_dict:" + }, + { + "line": 859, + "text": " del serializable_config_dict[\"_attn_implementation_internal\"]" + }, + { + "line": 880, + "text": " if \"_attn_implementation_internal\" in output:" + }, + { + "line": 881, + "text": " del output[\"_attn_implementation_internal\"]" + }, + { + "line": 1134, + "text": "def get_configuration_file(configuration_files: List[str]) -> str:" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed1134 function consumes configuration_files list from model config in shared from_pretrained path. Fixed repository name reduces caller control but unpinned upstream/cache config remains an input; token length does not bound config filename regex.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Patch4.51.0; selected candidate5.10.0 needs actual loader/tokenizer/model compatibility and immutable artifact evidence.", + "disposition": "Fix available but blocked by compatibility", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-q2wp-rjmx-x6x9", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76", + "https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca", + "https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29", + "https://nvd.nist.gov/vuln/detail/CVE-2025-3263", + "https://osv.dev/vulnerability/GHSA-q2wp-rjmx-x6x9", + "https://osv.dev/vulnerability/PYSEC-2026-1987", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-q2wp-rjmx-x6x9", + "retrievedUtc": "2026-10-25T06:30:33.736232+00:00", + "status": 200, + "sha256": "42ca6c9653a4eced299bb89de544859e9cd1dd242018462554dd357e5fdcc17f", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-q2wp-rjmx-x6x9-osv-824bb9ab.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-q2wp-rjmx-x6x9", + "retrievedUtc": "2026-10-25T06:30:33.813431+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-q2wp-rjmx-x6x9-6ba29abc.raw", + "sha256": "e411288ffb7ec6e67093f632b00d97d1ee101ba1acaaac52587d0f86af79b712", + "capturedFileMtimeUtc": "2026-10-25T06:24:02.289990+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.51.0" + ] + }, + { + "groupId": "CVE-2025-5197", + "package": "transformers", + "identifiers": [ + "CVE-2025-5197", + "GHSA-9356-575x-2w9m", + "PYSEC-2026-1983" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-9356-575x-2w9m", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-9356-575x-2w9m/GHSA-9356-575x-2w9m.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-1983", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-1983.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "4.53.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 4.53.0", + "first_patched_version": "4.53.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2025-08-06T18:15:20Z", + "refreshedOsvId": "GHSA-9356-575x-2w9m", + "refreshedOsvModified": "2026-09-10T03:50:26.988216861Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.53.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-9356-575x-2w9m/GHSA-9356-575x-2w9m.json" + } + } + ], + "vulnerableFunction": "convert_tf_weight_name_to_pt_weight_name ReDoS", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/modeling_tf_pytorch_utils.py", + "exists": true, + "sha256": "7891db6aa37a3abcf77c611e4b23f6d7738c0a34d6b77239dc76b6812b51f73a", + "symbolMatches": [ + { + "line": 55, + "text": "def convert_tf_weight_name_to_pt_weight_name(" + }, + { + "line": 203, + "text": " state_dict = torch.load(pt_path, map_location=\"cpu\", **weights_only_kwarg)" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed55 TF→PyTorch converter consumes tensor weight names; app default PyTorch from_pretrained does not request from_tf or TensorFlow conversion. Checkpoint download route does not automatically imply this conversion.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Different converter; no user weight-name input. Reassess if cross-framework checkpoint conversion added.", + "disposition": "Mitigated with residual risk", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-9356-575x-2w9m", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/701caef704e356dc2f9331cc3fd5df0eccb4720a", + "https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b", + "https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf", + "https://nvd.nist.gov/vuln/detail/CVE-2025-5197", + "https://osv.dev/vulnerability/GHSA-9356-575x-2w9m", + "https://osv.dev/vulnerability/PYSEC-2026-1983", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-9356-575x-2w9m", + "retrievedUtc": "2026-10-25T06:30:33.828125+00:00", + "status": 200, + "sha256": "d0117920cc362241684434b65ac04c3a19337d6fb90705a464fba80c3324b40f", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-9356-575x-2w9m-osv-fedb8bba.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-9356-575x-2w9m", + "retrievedUtc": "2026-10-25T06:30:33.931492+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-9356-575x-2w9m-c4e43e2c.raw", + "sha256": "3ca570af1ecffd2df0804ef233b6508d217c93701c178163f0c13bd81305ccf7", + "capturedFileMtimeUtc": "2026-10-25T06:24:02.365380+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "4.53.0" + ] + }, + { + "groupId": "CVE-2026-1839", + "package": "transformers", + "identifiers": [ + "CVE-2026-1839", + "GHSA-69w3-r845-3855", + "PYSEC-2026-2288" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "MODERATE" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-69w3-r845-3855", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.0rc3" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69w3-r845-3855/GHSA-69w3-r845-3855.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-2288", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-2288.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "5.0.0", + "5.0.0rc3" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 5.0.0rc3", + "first_patched_version": "5.0.0rc3", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-04-08T00:17:59Z", + "refreshedOsvId": "GHSA-69w3-r845-3855", + "refreshedOsvModified": "2026-09-10T03:50:43.300048881Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.0rc3" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-69w3-r845-3855/GHSA-69w3-r845-3855.json" + } + } + ], + "vulnerableFunction": "Trainer._load_rng_state unsafe torch.load", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/trainer.py", + "exists": true, + "sha256": "c0cb1a6b002b0976197c0fbb7d8dcc460993b9dd5eb9ceb816dd1ec3702d8ede", + "symbolMatches": [ + { + "line": 276, + "text": " # with torch.load(weights_only=True). Starting from 2.6 weights_only=True becomes" + }, + { + "line": 548, + "text": " \"You cannot fine-tune quantized model with `torch.compile()` make sure to pass a non-compiled model when fine-tuning a quantized model with PEFT\"" + }, + { + "line": 787, + "text": " # torch.compile" + }, + { + "line": 789, + "text": " raise RuntimeError(\"Using torch.compile requires PyTorch 2.0 or higher.\")" + }, + { + "line": 1821, + "text": " def torch_jit_model_eval(self, model, dataloader, training=False):" + }, + { + "line": 1830, + "text": " jit_model.eval()" + }, + { + "line": 1838, + "text": " jit_model = torch.jit.trace(jit_model, example_kwarg_inputs=example_batch, strict=False)" + }, + { + "line": 1840, + "text": " jit_model = torch.jit.trace(" + }, + { + "line": 1851, + "text": " jit_model = torch.jit.trace(jit_model, jit_inputs, strict=False)" + }, + { + "line": 1852, + "text": " jit_model = torch.jit.freeze(jit_model)" + }, + { + "line": 1873, + "text": " model.eval()" + }, + { + "line": 1939, + "text": " model = self.torch_jit_model_eval(model, dataloader, training)" + }, + { + "line": 2804, + "text": " state_dict = torch.load(" + }, + { + "line": 2825, + "text": " state_dict = safetensors.torch.load_file(safe_weights_file, device=\"cpu\")" + }, + { + "line": 2827, + "text": " state_dict = torch.load(" + }, + { + "line": 2924, + "text": " state_dict = safetensors.torch.load_file(best_safe_model_path, device=\"cpu\")" + }, + { + "line": 2926, + "text": " state_dict = torch.load(" + }, + { + "line": 2983, + "text": " state_dict = safetensors.torch.load_file(best_safe_model_path, device=\"cpu\")" + }, + { + "line": 2985, + "text": " state_dict = torch.load(" + }, + { + "line": 3081, + "text": " def _load_rng_state(self, checkpoint):" + }, + { + "line": 3105, + "text": " checkpoint_rng_state = torch.load(rng_file)" + }, + { + "line": 3358, + "text": " self.lr_scheduler.load_state_dict(torch.load(os.path.join(checkpoint, SCHEDULER_NAME)))" + }, + { + "line": 3388, + "text": " optimizer_state = torch.load(" + }, + { + "line": 3397, + "text": " optimizer_state = torch.load(os.path.join(checkpoint, OPTIMIZER_NAME), map_location=\"cpu\")" + }, + { + "line": 3399, + "text": " lr_scheduler_state = torch.load(os.path.join(checkpoint, SCHEDULER_NAME), map_location=\"cpu\")" + }, + { + "line": 3441, + "text": " torch.load(os.path.join(checkpoint, OPTIMIZER_NAME), map_location=map_location)" + }, + { + "line": 3444, + "text": " self.lr_scheduler.load_state_dict(torch.load(os.path.join(checkpoint, SCHEDULER_NAME)))" + }, + { + "line": 4233, + "text": " model.eval()" + }, + { + "line": 4235, + "text": " self.optimizer.eval()" + }, + { + "line": 4862, + "text": " model.eval()" + }, + { + "line": 4864, + "text": " self.optimizer.eval()" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Installed3081 helper loads training rng_state checkpoint; app uses no Trainer, training resume or optimizer. GHSA text additionally limits exploit to torch below2.6; observed metadata2.6.0 does not satisfy that textual condition, although database Transformers range still matches.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Both operation separation and vendor torch<2.6 precondition; this does not clear independent torch weights_only flaw24747.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-69w3-r845-3855", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396", + "https://github.com/huggingface/transformers/releases/tag/v5.0.0rc3", + "https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485", + "https://nvd.nist.gov/vuln/detail/CVE-2026-1839", + "https://osv.dev/vulnerability/GHSA-69w3-r845-3855", + "https://osv.dev/vulnerability/PYSEC-2026-2288" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-69w3-r845-3855", + "retrievedUtc": "2026-10-25T06:30:33.934499+00:00", + "status": 200, + "sha256": "275a8d5a753f419f75928f89e199b30058bb2393c7b7bc48cf0bf94f8a8864d5", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-69w3-r845-3855-osv-5b667ca3.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-69w3-r845-3855", + "retrievedUtc": "2026-10-25T06:30:34.036601+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-69w3-r845-3855-9d1bb098.raw", + "sha256": "87752b980761a7056d595e2a991718566d124794978b5c3304914ae8f8f2336c", + "capturedFileMtimeUtc": "2026-10-25T06:24:02.453450+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "5.0.0rc3" + ] + }, + { + "groupId": "CVE-2026-4372", + "package": "transformers", + "identifiers": [ + "CVE-2026-4372", + "GHSA-29pf-2h5f-8g72", + "PYSEC-2026-2289" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-29pf-2h5f-8g72", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-29pf-2h5f-8g72/GHSA-29pf-2h5f-8g72.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-2289", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-2289.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "5.3.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 5.3.0", + "first_patched_version": "5.3.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-07-01T18:00:11Z", + "refreshedOsvId": "GHSA-29pf-2h5f-8g72", + "refreshedOsvModified": "2026-09-10T03:50:45.254378086Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-29pf-2h5f-8g72/GHSA-29pf-2h5f-8g72.json" + } + } + ], + "vulnerableFunction": "model initialization config attention-kernel code loading", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py", + "exists": true, + "sha256": "977e5f089928f6a4dd4db0270e411c898921c7cd6ba6d12e1c3f88a1916c5820", + "symbolMatches": [ + { + "line": 479, + "text": " loader = safe_load_file if load_safe else partial(torch.load, map_location=\"cpu\", **weights_only_kwarg)" + }, + { + "line": 493, + "text": "def load_state_dict(" + }, + { + "line": 535, + "text": " return torch.load(" + }, + { + "line": 665, + "text": " def load(module: nn.Module, state_dict, prefix=\"\", assign_to_params_buffers=False):" + }, + { + "line": 1424, + "text": " if config._attn_implementation_internal is not None:" + }, + { + "line": 1427, + "text": " attn_implementation = config._attn_implementation_internal" + }, + { + "line": 1460, + "text": " def _autoset_attn_implementation(" + }, + { + "line": 1475, + "text": " # Here we use config._attn_implementation_internal to check whether the attention implementation was explicitely set by the user." + }, + { + "line": 1479, + "text": " if hasattr(config, \"_attn_implementation_internal\") and config._attn_implementation_internal is not None:" + }, + { + "line": 1501, + "text": " requested_attn_implementation = config._attn_implementation_internal" + }, + { + "line": 1516, + "text": " sub_config._attn_implementation_internal = curr_attn_implementation" + }, + { + "line": 2618, + "text": " def save_pretrained(" + }, + { + "line": 3151, + "text": " The model is set in evaluation mode by default using `model.eval()` (Dropout modules are deactivated). To train" + }, + { + "line": 4269, + "text": " model.eval()" + }, + { + "line": 5064, + "text": " if is_torch_fx_proxy(input_ids) or torch.jit.is_tracing() or is_torchdynamo_compiling():" + }, + { + "line": 5163, + "text": " \"\"\"Return a `torch.compile`'d version of `self.__call__`. This is useful to dynamically choose between" + }, + { + "line": 5174, + "text": " self._compiled_call = torch.compile(self.__call__, **compile_config.to_dict())" + } + ] + }, + "actualCallPathAndUntrustedReachability": "Shared config attention field exists in4.48.3, but _autoset_attn_implementation1486 rejects non-eager/non-known attention values with ValueError1498. No Hub kernel download dispatch in that method. Vendor describes later kernel-repository execution via serialized field; broad <5.3 range needs version-specific confirmation.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Strong source evidence of older allowlist differs from broad range; need negative runtime config test/patch-introduction evidence before scoped Not affected. Upgrade candidate fixes broad range but no compatibility pass here.", + "disposition": "Unresolved", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Model/checkpoint RCE boundary remains open.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-29pf-2h5f-8g72", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f", + "https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884", + "https://nvd.nist.gov/vuln/detail/CVE-2026-4372", + "https://osv.dev/vulnerability/GHSA-29pf-2h5f-8g72", + "https://osv.dev/vulnerability/PYSEC-2026-2289" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-29pf-2h5f-8g72", + "retrievedUtc": "2026-10-25T06:30:34.053242+00:00", + "status": 200, + "sha256": "384e73b8dd93f7b3c7fef64ef2d328569b57247d6b3e6d6bb97c3416a0fc0ddf", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-29pf-2h5f-8g72-osv-558eae13.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-29pf-2h5f-8g72", + "retrievedUtc": "2026-10-25T06:30:34.116687+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-29pf-2h5f-8g72-13718d53.raw", + "sha256": "82fcc1a7312f325cc6fab91bbd759deb405d20eb9ef9ce3a80943ba28e3813bb", + "capturedFileMtimeUtc": "2026-10-25T06:24:02.664490+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "5.3.0" + ] + }, + { + "groupId": "CVE-2026-5241", + "package": "transformers", + "identifiers": [ + "CVE-2026-5241", + "GHSA-fgcw-684q-jj6r", + "PYSEC-2026-2290" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-fgcw-684q-jj6r", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.5.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fgcw-684q-jj6r/GHSA-fgcw-684q-jj6r.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-2290", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.2.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0" + ], + "ecosystem_specific": {}, + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-2290.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "5.5.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 5.5.0", + "first_patched_version": "5.5.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-07-21T12:33:27Z", + "refreshedOsvId": "GHSA-fgcw-684q-jj6r", + "refreshedOsvModified": "2026-09-10T03:50:49.345942449Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.5.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fgcw-684q-jj6r/GHSA-fgcw-684q-jj6r.json" + } + } + ], + "vulnerableFunction": "LightGlue nested AutoConfig remote-code override", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/models/lightglue", + "exists": false + }, + "actualCallPathAndUntrustedReachability": "No LightGlue files/package in installed4.48.3; installed AutoModelForSeq2SeqLM maps BART and not LightGlue. Vendor report describes5.2.0 despite broad<5.5 range.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "Named vulnerable architecture absent from installed distribution; candidate5.10 >=5.5 patch. This does not clear shared model-load vulnerabilities.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://access.redhat.com/errata/RHSA-2026:34456", + "https://access.redhat.com/errata/RHSA-2026:37275", + "https://access.redhat.com/errata/RHSA-2026:42644", + "https://access.redhat.com/security/cve/CVE-2026-5241", + "https://bugzilla.redhat.com/show_bug.cgi?id=2484384", + "https://github.com/advisories/GHSA-fgcw-684q-jj6r", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e", + "https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2026-2290.yaml", + "https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619", + "https://nvd.nist.gov/vuln/detail/CVE-2026-5241", + "https://osv.dev/vulnerability/GHSA-fgcw-684q-jj6r", + "https://osv.dev/vulnerability/PYSEC-2026-2290", + "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-fgcw-684q-jj6r", + "retrievedUtc": "2026-10-25T06:30:34.151536+00:00", + "status": 200, + "sha256": "bc011417c43f1c719a80ad5680cd59a552c9ec5acbd8609e215430941773bf1e", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-fgcw-684q-jj6r-osv-5067071d.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-fgcw-684q-jj6r", + "retrievedUtc": "2026-10-25T06:30:34.222707+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-fgcw-684q-jj6r-183213d6.raw", + "sha256": "9de7553451b93ea2cbf8a4a75e2ffa84fd4058628105e6e48c17df212cb21f4c", + "capturedFileMtimeUtc": "2026-10-25T06:24:02.755306+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "5.5.0" + ] + }, + { + "groupId": "CVE-2026-9856", + "package": "transformers", + "identifiers": [ + "CVE-2026-9856", + "GHSA-xrqw-3rrv-vx5w", + "PYSEC-2026-3929" + ], + "baselineLockedVersion": "4.48.3", + "currentLockedVersionAtResearch": "4.48.3", + "publishedSeverityLabels": [ + "HIGH" + ], + "cvssVectors": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" + }, + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" + } + ], + "baselineAffectedRangesAndVersions": [ + { + "recordId": "GHSA-xrqw-3rrv-vx5w", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.10.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.5.0", + "5.5.1", + "5.5.2", + "5.5.3", + "5.5.4", + "5.6.0", + "5.6.1", + "5.6.2", + "5.7.0", + "5.8.0", + "5.8.1", + "5.9.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xrqw-3rrv-vx5w/GHSA-xrqw-3rrv-vx5w.json" + } + } + ] + }, + { + "recordId": "PYSEC-2026-3929", + "affected": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.10.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.5.0", + "5.5.1", + "5.5.2", + "5.5.3", + "5.5.4", + "5.6.0", + "5.6.1", + "5.6.2", + "5.7.0", + "5.8.0", + "5.8.1", + "5.9.0" + ], + "database_specific": { + "source": "https://github.com/pypa/advisory-database/blob/main/vulns/transformers/PYSEC-2026-3929.yaml" + } + } + ] + } + ], + "baselinePublishedFixedVersionEvents": [ + "5.10.0" + ], + "refreshedGithubVulnerabilities": [ + { + "package": { + "ecosystem": "pip", + "name": "transformers" + }, + "vulnerable_version_range": "< 5.10.0", + "first_patched_version": "5.10.0", + "vulnerable_functions": [] + } + ], + "refreshedGithubUpdatedAt": "2026-09-01T18:58:09Z", + "refreshedOsvId": "GHSA-xrqw-3rrv-vx5w", + "refreshedOsvModified": "2026-09-10T12:25:36.528730268Z", + "refreshedOsvAffectedRangesAndVersions": [ + { + "package": { + "name": "transformers", + "ecosystem": "PyPI", + "purl": "pkg:pypi/transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.10.0" + } + ] + } + ], + "versions": [ + "0.1", + "2.0.0", + "2.1.0", + "2.1.1", + "2.10.0", + "2.11.0", + "2.2.0", + "2.2.1", + "2.2.2", + "2.3.0", + "2.4.0", + "2.4.1", + "2.5.0", + "2.5.1", + "2.6.0", + "2.7.0", + "2.8.0", + "2.9.0", + "2.9.1", + "3.0.0", + "3.0.1", + "3.0.2", + "3.1.0", + "3.2.0", + "3.3.0", + "3.3.1", + "3.4.0", + "3.5.0", + "3.5.1", + "4.0.0", + "4.0.0rc1", + "4.0.1", + "4.1.0", + "4.1.1", + "4.10.0", + "4.10.1", + "4.10.2", + "4.10.3", + "4.11.0", + "4.11.1", + "4.11.2", + "4.11.3", + "4.12.0", + "4.12.1", + "4.12.2", + "4.12.3", + "4.12.4", + "4.12.5", + "4.13.0", + "4.14.0", + "4.14.1", + "4.15.0", + "4.16.0", + "4.16.1", + "4.16.2", + "4.17.0", + "4.18.0", + "4.19.0", + "4.19.1", + "4.19.2", + "4.19.3", + "4.19.4", + "4.2.0", + "4.2.1", + "4.2.2", + "4.20.0", + "4.20.1", + "4.21.0", + "4.21.1", + "4.21.2", + "4.21.3", + "4.22.0", + "4.22.1", + "4.22.2", + "4.23.0", + "4.23.1", + "4.24.0", + "4.25.0", + "4.25.1", + "4.26.0", + "4.26.1", + "4.27.0", + "4.27.1", + "4.27.2", + "4.27.3", + "4.27.4", + "4.28.0", + "4.28.1", + "4.29.0", + "4.29.1", + "4.29.2", + "4.3.0", + "4.3.0rc1", + "4.3.1", + "4.3.2", + "4.3.3", + "4.30.0", + "4.30.1", + "4.30.2", + "4.31.0", + "4.32.0", + "4.32.1", + "4.33.0", + "4.33.1", + "4.33.2", + "4.33.3", + "4.34.0", + "4.34.1", + "4.35.0", + "4.35.1", + "4.35.2", + "4.36.0", + "4.36.1", + "4.36.2", + "4.37.0", + "4.37.1", + "4.37.2", + "4.38.0", + "4.38.1", + "4.38.2", + "4.39.0", + "4.39.1", + "4.39.2", + "4.39.3", + "4.4.0", + "4.4.1", + "4.4.2", + "4.40.0", + "4.40.1", + "4.40.2", + "4.41.0", + "4.41.1", + "4.41.2", + "4.42.0", + "4.42.1", + "4.42.2", + "4.42.3", + "4.42.4", + "4.43.0", + "4.43.1", + "4.43.2", + "4.43.3", + "4.43.4", + "4.44.0", + "4.44.1", + "4.44.2", + "4.45.0", + "4.45.1", + "4.45.2", + "4.46.0", + "4.46.1", + "4.46.2", + "4.46.3", + "4.47.0", + "4.47.1", + "4.48.0", + "4.48.1", + "4.48.2", + "4.48.3", + "4.49.0", + "4.5.0", + "4.5.1", + "4.50.0", + "4.50.1", + "4.50.2", + "4.50.3", + "4.51.0", + "4.51.1", + "4.51.2", + "4.51.3", + "4.52.0", + "4.52.1", + "4.52.2", + "4.52.3", + "4.52.4", + "4.53.0", + "4.53.1", + "4.53.2", + "4.53.3", + "4.54.0", + "4.54.1", + "4.55.0", + "4.55.1", + "4.55.2", + "4.55.3", + "4.55.4", + "4.56.0", + "4.56.1", + "4.56.2", + "4.57.0", + "4.57.1", + "4.57.2", + "4.57.3", + "4.57.4", + "4.57.5", + "4.57.6", + "4.6.0", + "4.6.1", + "4.7.0", + "4.8.0", + "4.8.1", + "4.8.2", + "4.9.0", + "4.9.1", + "4.9.2", + "5.0.0", + "5.0.0rc0", + "5.0.0rc1", + "5.0.0rc2", + "5.0.0rc3", + "5.1.0", + "5.2.0", + "5.3.0", + "5.4.0", + "5.5.0", + "5.5.1", + "5.5.2", + "5.5.3", + "5.5.4", + "5.6.0", + "5.6.1", + "5.6.2", + "5.7.0", + "5.8.0", + "5.8.1", + "5.9.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xrqw-3rrv-vx5w/GHSA-xrqw-3rrv-vx5w.json" + } + } + ], + "vulnerableFunction": "tokenizer/Processor save_pretrained chat_template traversal", + "installedSource": { + "path": "tools/summarizer/.venv/Lib/site-packages/transformers/tokenization_utils_base.py", + "exists": true, + "sha256": "9f5f7e9c397238447319c3af75cae65e529c928dacaed1faa39d7045936ac49f", + "symbolMatches": [ + { + "line": 2337, + "text": " def save_pretrained(" + } + ] + }, + "actualCallPathAndUntrustedReachability": "save_pretrained exists, but application only from_pretrained, tokenizer call/decode, model.generate; no tokenizer/processor export or user save path. Cache download writes are Hub file_download, not save_pretrained.", + "selectedBartPath": "app._load_runtime -> AutoTokenizer/AutoModelForSeq2SeqLM.from_pretrained; Auto bart mappings -> BartTokenizer/BartTokenizerFast and BartForConditionalGeneration; eval -> tokenizer(input,max_length1024) -> no_grad generate(num_beams3) -> decode. Artifact/config identity is not yet proven.", + "currentMitigationAndResidual": "No named save path in service; retain broad installed-package advisory and require5.10 patch if export introduced.", + "disposition": "Not affected with evidence", + "dispositionScope": "Read-only research assessment of current installed code/service path. Root qualification may supersede; no owner acceptance or patched deployment implied.", + "confidence": "high for cited source/API separation; limited for exact native/runtime model internals and artifact identity", + "remainingSeverity": "Published severity retained; no quantitative downgrade. Package-range finding remains unless exact scoped disposition accepted.", + "compatibilityRisk": "Torch/Transformers require separately validated CPU graph, tokenizer/model/checkpoint and inference qualification without changing model choice. Filelock4 changes some shared-cache protocols; no live cache migration authorized.", + "packageSpecificTestNeeds": "AutoTokenizer and AutoModelForSeq2SeqLM imports/mapping; fixed actual BART tokenizer IDs/decode; selected checkpoint load/generate; no remote-code dispatch; missing model returns503; config filename regex bounded safe regression; hub/cache locking; no provider calls.", + "primarySources": [ + "https://github.com/advisories/GHSA-xrqw-3rrv-vx5w", + "https://github.com/huggingface/transformers", + "https://github.com/huggingface/transformers/commit/eaaaf8494dd5386634ae37d1d122212fdc315be5", + "https://github.com/huggingface/transformers/pull/46191", + "https://huntr.com/bounties/362824d5-fe18-40e8-a6cf-62277f97a170", + "https://nvd.nist.gov/vuln/detail/CVE-2026-9856", + "https://osv.dev/vulnerability/GHSA-xrqw-3rrv-vx5w", + "https://osv.dev/vulnerability/PYSEC-2026-3929", + "https://pypi.org/project/transformers" + ], + "refreshEvidence": [ + { + "url": "https://api.osv.dev/v1/vulns/GHSA-xrqw-3rrv-vx5w", + "retrievedUtc": "2026-10-25T06:30:34.226276+00:00", + "status": 200, + "sha256": "69d4bde72ec283c28e68b63c8beaec2b26e5f66f2d92266642fe5e0121bd58d5", + "contentType": "application/json", + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-xrqw-3rrv-vx5w-osv-0abe501e.raw" + }, + { + "url": "https://api.github.com/advisories/GHSA-xrqw-3rrv-vx5w", + "retrievedUtc": "2026-10-25T06:30:34.232805+00:00", + "error": "HTTP Error 403: rate limit exceeded", + "priorSuccessfulResponse": { + "file": ".artifacts/p9-sec-02/advisory-research/GHSA-xrqw-3rrv-vx5w-6b4e25f3.raw", + "sha256": "31f880d4690300583414faa34462c9d52c70efd5bf933e2e65b5eef65c9eca17", + "capturedFileMtimeUtc": "2026-10-25T06:24:02.725018+00:00", + "note": "First54-request batch succeeded; repeat API request hit rate limit. Timestamp from local saved-response mtime, not reconstructed HTTP timestamp." + } + } + ], + "aliasAccounting": "One alias group. All aliases retained; provider records are not separate vulnerabilities.", + "currentFirstPatchedVersions": [ + "5.10.0" + ] + } + ] +} diff --git a/docs/redesign/phase-9/p9-sec-02/ci-assessment.json b/docs/redesign/phase-9/p9-sec-02/ci-assessment.json new file mode 100644 index 0000000..43c2c0f --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/ci-assessment.json @@ -0,0 +1,344 @@ +{ + "schemaVersion": 1, + "reportLocalDate": "2026-10-25", + "timezone": "Europe/Paris", + "observedUtc": "2026-10-25T06:23:27.915835+00:00", + "baselineCommit": "f17dba2ec06ea8f53c2785eaaebd25abc515ebf8", + "branch": "fix/p9-model-cache-and-ci-qualification", + "hostedVerdict": "BLOCKED", + "isolationVerdict": "UNVERIFIED", + "currentLiveHostConfig": "UNKNOWN; metadata cannot certify effective HostConfig", + "scope": "Bounded read-only CI API GET metadata and official pinned source retrieval; no runtime logs or host inspection", + "giteaVersion": { + "version": "1.26.0" + }, + "repositoryPermissions": { + "admin": true, + "push": true, + "pull": true + }, + "httpStatuses": { + "version": 200, + "repository": 200, + "repository-runners": 200, + "instance-runners": 403, + "user": 403, + "runs-latest100": 200, + "runs-branch-query": 200, + "jobs-855": 200, + "jobs-854": 200 + }, + "repositoryRunners": { + "runners": [ + { + "id": 3, + "name": "pi-runner-1", + "status": "offline", + "busy": false, + "disabled": false, + "ephemeral": false, + "labels": [ + { + "id": 0, + "name": "ubuntu-latest", + "type": "custom" + }, + { + "id": 1, + "name": "ubuntu-22.04", + "type": "custom" + } + ] + } + ], + "total_count": 1 + }, + "observedLatestRunCount": 50, + "latestObservedRuns": [ + { + "id": 855, + "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f", + "head_branch": "main", + "status": "completed", + "conclusion": "success", + "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/855", + "created_at": null, + "updated_at": null + }, + { + "id": 854, + "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f", + "head_branch": "main", + "status": "completed", + "conclusion": "success", + "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/854", + "created_at": null, + "updated_at": null + }, + { + "id": 853, + "head_sha": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28", + "head_branch": "fix/p9-ci-and-requalification", + "status": "completed", + "conclusion": "failure", + "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/853", + "created_at": null, + "updated_at": null + }, + { + "id": 852, + "head_sha": "7092697cb3e20a5f22e173648fd544de3de6c553", + "head_branch": "fix/p9-ci-and-requalification", + "status": "completed", + "conclusion": "failure", + "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/852", + "created_at": null, + "updated_at": null + }, + { + "id": 851, + "head_sha": "5ac11549b2caa27469aa9fb2b5b9ed402471a453", + "head_branch": "fix/p9-ci-and-requalification", + "status": "completed", + "conclusion": "failure", + "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/851", + "created_at": null, + "updated_at": null + } + ], + "latestAccessibleJobs": [ + { + "runId": 855, + "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f", + "jobs": [ + { + "id": 1745, + "name": "backup", + "status": "completed", + "conclusion": "success", + "runner_id": 5, + "runner_name": "Live-Runner", + "started_at": "2026-10-25T01:00:47Z", + "completed_at": "2026-10-25T01:01:04Z" + } + ] + }, + { + "runId": 854, + "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f", + "jobs": [ + { + "id": 1744, + "name": "backup", + "status": "completed", + "conclusion": "success", + "runner_id": 5, + "runner_name": "Live-Runner", + "started_at": "2026-10-25T00:01:21Z", + "completed_at": "2026-10-25T00:01:38Z" + } + ] + } + ], + "taskBranchQuery": { + "observedCount": 0, + "allReturnedRowsMatchRequestedBranch": true, + "matchingRunIds": [], + "note": "An empty or ignored query is not proof of all historical branch executions." + }, + "taskBranchRunsInLatestWindow": [], + "historicalRuntimeEvidence": { + "runId": 853, + "jobId": 1743, + "sourceCommit": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28", + "logSha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134", + "effectiveHostNetworking": true, + "effectiveDockerSocketBind": true, + "privileged": false, + "guardExitCode": 1, + "mariaDbExecuted": false, + "historicalIsolationVerdict": "UNSAFE for the proposed database lane" + }, + "sourceCapability": { + "runnerVersionReportedHistorically": "v0.4.1", + "runnerSourceCommit": "9aafec169b7ebf3d71df2b06780868fb552b435e", + "actVersion": "v0.261.10", + "nativePrivateServicesSupportedInPinnedSource": true, + "installedBinaryMatched": false, + "sources": [ + { + "name": "docs", + "url": "https://docs.gitea.com/1.26/usage/actions/act-runner/", + "httpStatus": 403, + "path": ".artifacts/p9-sec-02/ci/sources-20261025/docs.txt", + "bytes": 17, + "sha256": "2938e9f1284180959e33ab1718d0793a72ff6e4cdb8108c34dcd14e69446de5c" + }, + { + "name": "config", + "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml", + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/sources-20261025/config.txt", + "bytes": 7511, + "sha256": "e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa" + }, + { + "name": "runner", + "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go", + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/sources-20261025/runner.txt", + "bytes": 9299, + "sha256": "857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590" + }, + { + "name": "engine", + "url": "https://gitea.com/gitea/act/raw/tag/v0.261.10/pkg/runner/run_context.go", + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/sources-20261025/engine.txt", + "bytes": 36451, + "sha256": "45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c" + } + ] + }, + "repositoryGuardAssessment": { + "unconditionalFirstStepFailure": true, + "taskBranchPushTrigger": false, + "pullRequestAndManualTriggers": true, + "runnerPreparationOccursBeforeGuard": true, + "sharedUbuntuLatestRouting": true, + "defaultLoopbackAndGeneratedSchemasPreserved": true, + "sourceManifest": [ + { + "path": ".gitea/workflows/mariadb-integration.yml", + "bytes": 1306, + "sha256": "f7579be39a4b4318567edf98ba8dff0d6991ceae96ae27b917e6847253b1f850" + }, + { + "path": "scripts/mariadb-integration.py", + "bytes": 4570, + "sha256": "410cede3ca8794de99735a579ac626a34b6a56ee89c6ef63880d692153c7cd97" + }, + { + "path": "scripts/test-mariadb-integration.py", + "bytes": 2938, + "sha256": "39aa5618724e74b859aceaf814bf08b9ea63a54205452805caa810a302441a80" + }, + { + "path": "JobTrackerApi.MariaDb.Tests/MariaDbDatabase.cs", + "bytes": 6716, + "sha256": "1375d97093f686f77d511ef6d81ad2d62ecf329aa6e7bf53036cd6e199035e40" + }, + { + "path": "docker-compose.database.yml", + "bytes": 1441, + "sha256": "bc4f0d19ef913f9e0f92540ed9a817e7bbf00d2f00ae80ed5b1acd43d55ba363" + }, + { + "path": ".gitea/workflows/backup.yml", + "bytes": 1008, + "sha256": "9a6a7a9d49f88b6d9383a2d688ef64b14c53c451d1669ae6bda642780d291f75" + }, + { + "path": ".gitea/workflows/ci-deploy.yml", + "bytes": 21659, + "sha256": "713a62a635b1f695c3e70d2484997fb3ce2a616bbaae3885f80c1be821cf98cf" + }, + { + "path": ".gitea/workflows/maintenance.yml", + "bytes": 2343, + "sha256": "49fac8dde43531338fc713ac2a367ec9ca55379c94fcee44c1957dd861df54f9" + } + ] + }, + "validation": { + "staticGuardAssertions": "PASS", + "offlinePythonGuardTests": { + "passed": 5, + "failed": 0, + "scope": "Mocked runner guard tests only; no Docker/service/database access", + "outputCaveat": "Expected injected cleanup failure17 and setup failure1 are test fixtures, not real service failures" + } + }, + "unknowns": [ + "Runner5 host/daemon ownership, installed binary identity, registration scope and current effective configuration", + "Production workload/credential/mount/egress separation", + "Job-token/fork/PR trust and secret scopes", + "Private service runtime, DNS and no published port/socket/host network/privilege", + "Cross-job/cache isolation and success/failure/cancel/crash recovery" + ], + "repositoryImprovementProposal": "Keep execution blocker. Optionally remove the broad pull_request event while isolation is unverified to prevent automatic runner preparation; review provider behavior and dedicated routing before re-enabling. No enabling transport change is justified before operator proof.", + "rawMetadataEvidence": [ + { + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/version.json", + "bytes": 20, + "sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e" + }, + { + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository.json", + "bytes": 2315, + "sha256": "cb29faeadc15e5761db1043edff1c9d810c43ffea38abc5e6cee8d410a20e94d" + }, + { + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository-runners.json", + "bytes": 232, + "sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45" + }, + { + "httpStatus": 403, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/instance-runners.json", + "bytes": 164, + "sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1" + }, + { + "httpStatus": 403, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/user.json", + "bytes": 163, + "sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b" + }, + { + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-latest100.json", + "bytes": 203780, + "sha256": "7c2ac0004b093f34f83804a9168f23af17c4036f79ed7ff48bcb30daa7822cf2" + }, + { + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-branch-query.json", + "bytes": 36, + "sha256": "c88e581390a4c04eaddaf6dc1bafd07c56d33e594c62ad3498c7313043b39bbf" + }, + { + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-855.json", + "bytes": 836, + "sha256": "8fddbb1014c708d1c088f45c874cffb2f1446d21d3412cda64e18917e94ed5c9" + }, + { + "httpStatus": 200, + "path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-854.json", + "bytes": 836, + "sha256": "6b7e0849d1eeca72cc264984e00bd4ae2bbb576aa541f7c2e8f26b38e4348b05" + } + ], + "actions": { + "hostedJobsDispatched": false, + "newRuntimeLogsDownloaded": false, + "runnerOrHostChanged": false, + "workflowChanged": false, + "dockerSocketAccess": false, + "secretValuesReadOrRetained": false, + "productionAccess": false, + "deployment": false + }, + "limits": [ + "Latest request limit100 returned50; bounded window, not full history", + "Branch query0 and no latest-window match do not prove provider filter support or exhaustive absence", + "Instance runners and user403 despite repository admin/push/pull", + "Official docs HTTPS request403; capability rests on freshly fetched immutable primary source matching prior hashes", + "Backup success metadata is not MariaDB execution or isolation evidence" + ], + "documentation": "CI_ASSESSMENT.md" +} diff --git a/docs/redesign/phase-9/p9-sec-02/model/ARTIFACTS.json b/docs/redesign/phase-9/p9-sec-02/model/ARTIFACTS.json new file mode 100644 index 0000000..233f115 --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/model/ARTIFACTS.json @@ -0,0 +1,164 @@ +{ + "safetensors": { + "schemaVersion": 1, + "observedUtc": "2026-10-25T06:29:24.469337+00:00", + "fixture": "jobjakt-p9-sec02-bart-cpu", + "scope": "Real BART weights/tokenizer/native CPU inference compatibility fixture. Random/untrained output is not production DistilBART inference, semantic quality, full-model memory/capacity or AI product qualification.", + "sourceRepository": "sshleifer/distilbart-cnn-12-6", + "sourceRevision": "a4f8f3ea906ed274767e9906dbaede7531d660ff", + "upstreamLicense": "Apache-2.0 verified in pinned model card", + "generation": { + "torch": "2.6.0", + "transformers": "4.48.3", + "parameters": 842704, + "seed": 73421, + "device": "cpu", + "kind": "Locally generated random-weight BART, not trained DistilBART or a quality fixture" + }, + "files": [ + { + "file": "README.md", + "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/README.md", + "gitBlobId": "ab24d89a622b44fba741e4383213ad300fc2345a", + "bytes": 1705, + "sha256": "e6114f9ddddd7aec5e9858b9849d1b53dc42b596420888b82fbf3f8defb64bf7", + "license": "Apache-2.0, pinned upstream model-card declaration" + }, + { + "file": "reference-distilbart-config.json", + "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/config.json", + "gitBlobId": "fade82e22ec4f4b61f6f2eb3986ce4a64a8e23df", + "bytes": 1802, + "sha256": "028d72a28b90a369eff3f99ceb585fbd2ababf070e8577d72c315757a49b8917", + "license": "Apache-2.0, pinned upstream model-card declaration" + }, + { + "file": "vocab.json", + "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/vocab.json", + "gitBlobId": "0a39732b2d8be8e493cab3da68b68cc3e28221de", + "bytes": 898822, + "sha256": "06b4d46c8e752d410213d9548eb27a54db70fda0319b6271fb8d59dead5e1cab", + "license": "Apache-2.0, pinned upstream model-card declaration" + }, + { + "file": "merges.txt", + "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/merges.txt", + "gitBlobId": "226b0752cac7789c48f0cb3ec53eda48b7be36cc", + "bytes": 456318, + "sha256": "1ce1664773c50f3e0cc8842619a93edc4624525b728b188a9e0be33b7726adc5", + "license": "Apache-2.0, pinned upstream model-card declaration" + }, + { + "file": "tokenizer_config.json", + "url": "https://huggingface.co/sshleifer/distilbart-cnn-12-6/resolve/a4f8f3ea906ed274767e9906dbaede7531d660ff/tokenizer_config.json", + "gitBlobId": "be4d21d94f3b4687e5a54d84bf6ab46ed0f8defd", + "bytes": 26, + "sha256": "5e04eb606e3a1583530a42e36c2a6b6615c86f34fe77e44d9ddeb43ff940931f", + "license": "Apache-2.0, pinned upstream model-card declaration" + }, + { + "file": "config.json", + "bytes": 1025, + "sha256": "563b819e93f153a49d6364d5c90878eec01ef78f99aae0d0c8c7ccce49e517a8", + "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights" + }, + { + "file": "generation_config.json", + "bytes": 200, + "sha256": "fdf2a5aa742aa3bd7fcf78a14d9aae0c599e55610e7856a35a4e89a38fed50f7", + "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights" + }, + { + "file": "model.safetensors", + "bytes": 3577252, + "sha256": "35ca2b5d2c6a28696cadd0fd7dfe483d499497e315db28dfa5a509bf13da7a68", + "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights" + }, + { + "file": "generate.py", + "bytes": 850, + "sha256": "006cd1354c98e72ce9a7f1f57c5b3e3fd1cf16836dcb4508ca9f9930b4777fa5", + "source": "Synthetic seeded BART generated locally using Apache-2.0 Transformers architecture; no downloaded weights" + } + ], + "downloadBytes": 1358673, + "weightBytes": 3577252, + "fullModelAbsent": true, + "fullModelRequiredWeightBytes": 1222317369, + "fullModelExpectedSha256": "3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea", + "cachePolicy": "Isolated package test cache only; never production/Ollama cache. Verify every file before loading; load offline/read-only; no floating revision." + }, + "weights-only": { + "schemaVersion": 1, + "observedUtc": "2026-10-25T06:29:24.469337+00:00", + "fixture": "jobjakt-p9-sec02-bart-bin-cpu", + "scope": "Same locally generated synthetic BART state_dict in the selected production model serialization family, exercising real weights_only PyTorch loading. No third-party downloaded pickle; not full DistilBART/quality qualification.", + "sourceRepository": "sshleifer/distilbart-cnn-12-6", + "sourceRevision": "a4f8f3ea906ed274767e9906dbaede7531d660ff", + "upstreamLicense": "Apache-2.0 verified in pinned model card", + "generation": { + "torch": "2.6.0", + "transformers": "4.48.3", + "parameters": 842704, + "seed": 73421, + "device": "cpu", + "kind": "Locally generated random-weight BART, not trained DistilBART or a quality fixture" + }, + "files": [ + { + "file": "config.json", + "bytes": 1124, + "sha256": "b4f823ea324a93c355ae2ae2447bed10fcdb769070eff435f175a6738f7d3c34", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + }, + { + "file": "generate-bin.py", + "bytes": 411, + "sha256": "5d1f53ea37cc199d876b27731a29dea74b4df7fed7151f67a49b848993517052", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + }, + { + "file": "generation_config.json", + "bytes": 200, + "sha256": "fdf2a5aa742aa3bd7fcf78a14d9aae0c599e55610e7856a35a4e89a38fed50f7", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + }, + { + "file": "merges.txt", + "bytes": 456318, + "sha256": "1ce1664773c50f3e0cc8842619a93edc4624525b728b188a9e0be33b7726adc5", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + }, + { + "file": "pytorch_model.bin", + "bytes": 3588356, + "sha256": "95d578c5706c9256a2f299a4288c0cdcae0fd303fa27e4474c34300f51f195cd", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + }, + { + "file": "README.md", + "bytes": 1705, + "sha256": "e6114f9ddddd7aec5e9858b9849d1b53dc42b596420888b82fbf3f8defb64bf7", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + }, + { + "file": "tokenizer_config.json", + "bytes": 26, + "sha256": "5e04eb606e3a1583530a42e36c2a6b6615c86f34fe77e44d9ddeb43ff940931f", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + }, + { + "file": "vocab.json", + "bytes": 898822, + "sha256": "06b4d46c8e752d410213d9548eb27a54db70fda0319b6271fb8d59dead5e1cab", + "source": "Copied verified tokenizer/config or locally generated synthetic state_dict" + } + ], + "downloadBytes": 1358673, + "weightBytes": 3588356, + "fullModelAbsent": true, + "fullModelRequiredWeightBytes": 1222317369, + "fullModelExpectedSha256": "3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea", + "cachePolicy": "Isolated package test cache only; never production/Ollama cache. Verify every file before loading; load offline/read-only; no floating revision." + } +} diff --git a/docs/redesign/phase-9/p9-sec-02/model/probe.py b/docs/redesign/phase-9/p9-sec-02/model/probe.py new file mode 100644 index 0000000..00ca339 --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/model/probe.py @@ -0,0 +1,49 @@ +"""Actual offline CPU inference; synthetic weights test compatibility, never quality.""" +from pathlib import Path +import importlib.metadata +import json +import os +import resource +import sys +import time +from verify import verify_fixture + +HERE = Path(__file__).resolve().parent +manifests = json.loads((HERE / 'ARTIFACTS.json').read_text()) +kind = sys.argv[1] +fixture = verify_fixture(Path(sys.argv[2]), manifests[kind]) +assert os.environ['HF_HUB_OFFLINE'] == os.environ['TRANSFORMERS_OFFLINE'] == '1' +os.environ.pop('AI_SERVICE_SKIP_MODEL_LOAD', None) +os.environ.pop('AI_SERVICE_EAGER_MODEL_LOAD', None) +os.environ['AI_SERVICE_TOKEN'] = 'p9-local-qualification-only' +sys.path.insert(0, '/app') +import torch +import app +from fastapi.testclient import TestClient + +torch.set_num_threads(1) +started = time.monotonic() +# Only this isolated qualification process selects synthetic weights; no inference is mocked. +app.MODEL_NAME = str(fixture) +assert app._ensure_runtime_loaded(), app.MODEL_LOAD_ERROR +assert app.model.__class__.__name__ == 'BartForConditionalGeneration' +assert str(app.device) == 'cpu' and not app.GPU_AVAILABLE +text = 'Åse Østby builds accessible Python and C# applications for reliable Norwegian career workflows.' +encoded = app.tokenizer(text, return_tensors='pt') +assert app.tokenizer.decode(encoded.input_ids[0], skip_special_tokens=True) == text +summary = app._model_summarize(text, 24, 8) +assert isinstance(summary, str) and summary +client = TestClient(app.app) +assert client.get('/health').json()['model_loaded'] is True +assert client.post('/summarize', json={'text': text}).status_code == 401 +headers = {'X-Ai-Service-Token': 'p9-local-qualification-only'} +body = {'text': text, 'max_length': 24, 'min_length': 8} +first = client.post('/summarize', json=body, headers=headers) +second = client.post('/summarize', json=body, headers=headers) +assert first.status_code == second.status_code == 200, first.text +assert first.json()['cached'] is False and second.json()['cached'] is True +assert first.json()['summary'] == second.json()['summary'] +verify_fixture(fixture, manifests[kind]) +elapsed = time.monotonic() - started +assert elapsed < 60 +print(json.dumps({'status': 'PASS', 'kind': kind, 'scope': 'Real synthetic BART/tokenizer/native CPU generation plus sidecar summary/auth/cache contract; no full DistilBART or semantic-quality claim.', 'modelClass': app.model.__class__.__name__, 'device': str(app.device), 'cudaAvailable': torch.cuda.is_available(), 'seconds': elapsed, 'maxRssKiB': resource.getrusage(resource.RUSAGE_SELF).ru_maxrss, 'versions': {name: importlib.metadata.version(name) for name in ['torch','transformers','filelock','huggingface-hub','tokenizers','safetensors']}, 'summary': summary, 'cacheRepeatedRead': True, 'fixtureUnchanged': True}), flush=True) diff --git a/docs/redesign/phase-9/p9-sec-02/model/test_verify.py b/docs/redesign/phase-9/p9-sec-02/model/test_verify.py new file mode 100644 index 0000000..53ed2f6 --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/model/test_verify.py @@ -0,0 +1,40 @@ +from pathlib import Path +import copy +import hashlib +import tempfile +import unittest +from verify import verify_fixture + + +class ArtifactIntegrity(unittest.TestCase): + def setUp(self): + self.temp = tempfile.TemporaryDirectory() + self.addCleanup(self.temp.cleanup) + self.directory = Path(self.temp.name) + (self.directory / 'model.safetensors').write_bytes(b'known fixture') + self.manifest = {'files': [{'file': 'model.safetensors', 'bytes': 13, 'sha256': hashlib.sha256(b'known fixture').hexdigest()}]} + + def test_accepts_exact_known_content(self): + self.assertEqual(verify_fixture(self.directory, self.manifest), self.directory.resolve()) + + def test_rejects_same_size_corruption(self): + (self.directory / 'model.safetensors').write_bytes(b'wrong fixture') + with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest) + + def test_rejects_missing_weight(self): + (self.directory / 'model.safetensors').unlink() + with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest) + + def test_rejects_traversal_and_duplicate_identity(self): + for value in ['../model.safetensors', '/model.safetensors']: + manifest = copy.deepcopy(self.manifest); manifest['files'][0]['file'] = value + with self.assertRaises(ValueError): verify_fixture(self.directory, manifest) + self.manifest['files'] *= 2 + with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest) + + def test_rejects_unlisted_model_code(self): + (self.directory / 'modeling_unreviewed.py').write_text('raise RuntimeError()') + with self.assertRaises(ValueError): verify_fixture(self.directory, self.manifest) + + +if __name__ == '__main__': unittest.main() diff --git a/docs/redesign/phase-9/p9-sec-02/model/verify.py b/docs/redesign/phase-9/p9-sec-02/model/verify.py new file mode 100644 index 0000000..8ea7667 --- /dev/null +++ b/docs/redesign/phase-9/p9-sec-02/model/verify.py @@ -0,0 +1,21 @@ +"""Verify committed qualification identities before loading an isolated model fixture.""" +from pathlib import Path +import hashlib + + +def verify_fixture(directory, manifest): + directory = Path(directory).resolve() + expected = set() + for entry in manifest['files']: + name = entry['file'] + if Path(name).name != name or name in ('.', '..'): + raise ValueError('Artifact name escapes fixture directory.') + file = directory / name + if name in expected or file.is_symlink() or not file.is_file(): + raise ValueError('Missing, duplicate or linked model artifact: ' + name) + expected.add(name) + if file.stat().st_size != entry['bytes'] or hashlib.sha256(file.read_bytes()).hexdigest() != entry['sha256']: + raise ValueError('Model artifact integrity mismatch: ' + name) + if not expected or {p.name for p in directory.iterdir()} - expected - {'manifest.json', 'generation.log'}: + raise ValueError('Unexpected artifact or empty manifest.') + return directory diff --git a/scripts/test-mariadb-workflow.py b/scripts/test-mariadb-workflow.py new file mode 100644 index 0000000..4ec42a5 --- /dev/null +++ b/scripts/test-mariadb-workflow.py @@ -0,0 +1,34 @@ +"""Repository quarantine guards; these never certify actual runner isolation.""" +from pathlib import Path +import re +import unittest + +WORKFLOW = Path(__file__).resolve().parents[1] / '.gitea/workflows/mariadb-integration.yml' + + +class MariaDbWorkflowQuarantine(unittest.TestCase): + def setUp(self): + self.text = WORKFLOW.read_text(encoding='utf-8') + + def test_requires_dedicated_routing_instead_of_shared_deployment_label(self): + self.assertRegex(self.text, r'(?m)^ runs-on: jobtracker-mariadb-isolated$') + self.assertNotRegex(self.text, r'(?m)^ runs-on: ubuntu-latest$') + + def test_untrusted_pull_requests_cannot_automatically_prepare_a_job(self): + self.assertNotRegex(self.text, r'(?m)^ pull_request(?:_target)?:') + + def test_operator_blocker_precedes_checkout_and_database_execution(self): + guard = self.text.index('- name: Require verified runner isolation') + checkout = self.text.index('- uses: actions/checkout') + self.assertLess(guard, checkout) + self.assertRegex(self.text[guard:checkout], r'(?m)^ exit 1$') + + def test_current_development_branch_keeps_a_visible_qualification_lane(self): + self.assertIn('fix/p9-model-cache-and-ci-qualification', self.text) + self.assertIn('python3 scripts/mariadb-integration.py', self.text) + self.assertNotIn('privileged:', self.text) + self.assertNotIn('/var/run/docker.sock', self.text) + + +if __name__ == '__main__': + unittest.main() diff --git a/tools/summarizer/app.py b/tools/summarizer/app.py index 85c2947..b0f2327 100644 --- a/tools/summarizer/app.py +++ b/tools/summarizer/app.py @@ -94,6 +94,8 @@ async def require_service_token(request: Request, call_next): _external_ai_allowed.reset(allowed_token) MODEL_NAME = "sshleifer/distilbart-cnn-12-6" +# Keep tokenizer and weights on the same reviewed immutable upstream snapshot. +MODEL_REVISION = "a4f8f3ea906ed274767e9906dbaede7531d660ff" MAX_INPUT_CHARS = 20000 MAX_CONTEXT_CHARS = 2200 MAX_EXTRACT_FILE_BYTES = 5 * 1024 * 1024 @@ -159,8 +161,8 @@ MODEL_DISABLED = SKIP_MODEL_LOAD def _load_runtime(): - tokenizer = AutoTokenizer.from_pretrained(MODEL_NAME) - model = AutoModelForSeq2SeqLM.from_pretrained(MODEL_NAME) + tokenizer = AutoTokenizer.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False) + model = AutoModelForSeq2SeqLM.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False, weights_only=True) model.eval() has_cuda = torch.cuda.is_available() device = torch.device("cuda" if has_cuda else "cpu") diff --git a/tools/summarizer/tests/test_app.py b/tools/summarizer/tests/test_app.py index f7aa37d..3d4b0f3 100644 --- a/tools/summarizer/tests/test_app.py +++ b/tools/summarizer/tests/test_app.py @@ -84,6 +84,37 @@ def test_health_reports_runtime_without_ollama_and_without_forcing_model_load(mo assert payload["ollama_loaded_models"] == [] +def test_model_load_pins_both_artifacts_and_denies_remote_code_and_unsafe_weights(monkeypatch): + module = load_app_module(monkeypatch) + calls = [] + + class LoadedModel: + def eval(self): + return self + + def to(self, device): + return self + + def tokenizer_loader(name, **options): + calls.append((name, options)) + return object() + + def model_loader(name, **options): + calls.append((name, options)) + return LoadedModel() + + monkeypatch.setattr(module.AutoTokenizer, "from_pretrained", tokenizer_loader) + monkeypatch.setattr(module.AutoModelForSeq2SeqLM, "from_pretrained", model_loader) + monkeypatch.setattr(module.torch.cuda, "is_available", lambda: False) + module._load_runtime() + + assert [name for name, _ in calls] == ["sshleifer/distilbart-cnn-12-6"] * 2 + for _, options in calls: + assert options.get("revision") == "a4f8f3ea906ed274767e9906dbaede7531d660ff" + assert options.get("trust_remote_code") is False + assert calls[1][1].get("weights_only") is True + + def test_summarize_returns_503_with_explicit_reason_when_model_loading_is_disabled(monkeypatch): module = load_app_module(monkeypatch) client = TestClient(module.app)