{ "schemaVersion": 1, "generatedUtc": "2026-10-25T07:11:14.466543+00:00", "scope": "Focused reassessment of9 NoFix groups plus numeric issue55554 against final locally built Linux CPU runtime image. Original44-row research remains historical and unchanged.", "gate": "SCOPED_SOURCE_ASSESSMENT_ONLY_NOT_GLOBAL_PATCH_OR_PRODUCTION_ACCEPTANCE", "sourceImage": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331", "qualificationImage": "sha256:15a8364ba158a8042d6183bdc58f8167e39a227b7addce3ccb7d35675fc6761f", "runtimeVersions": { "torch": "2.13.0+cpu", "transformers": "5.10.0", "filelock": "4.2.1", "huggingface-hub": "1.33.0", "tokenizers": "0.22.2" }, "appSha256": "aab24c7f64868fcb93a6133aa7b2087b23f98469e89e4c84fa040a022b0a8dfc", "lockSha256": "3a3afc529f0076a1b5d67082c9269c22c12f52c47ecf95ce0c76c37b39d8297a", "captureProcess": { "startedUtc": "2026-10-25T07:05:16.437530+00:00", "finishedUtc": "2026-10-25T07:05:17.336071+00:00", "command": [ "docker", "run", "--rm", "--entrypoint", "python", "--network", "none", "--read-only", "--user", "65534:65534", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "32", "--cpus", "1", "--memory", "512m", "-e", "PYTHONDONTWRITEBYTECODE=1", "--mount", "type=bind,src=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-sec-02\\current-source,dst=/capture,readonly", "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331", "/capture/capture.py" ], "image": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331", "exitCode": 0, "sourceSha256": "0bd220f790c2623f0b0f48f1f604e54d65d765b8a6bedc11ec9a2d9471be0bf7", "timeoutSeconds": 60, "scope": "One network-none read-only static source capture. No model/module imports, inference or tests." }, "captureFileSha256": "0bd220f790c2623f0b0f48f1f604e54d65d765b8a6bedc11ec9a2d9471be0bf7", "generationCaptureProcess": { "startedUtc": "2026-10-25T07:09:31.000739+00:00", "finishedUtc": "2026-10-25T07:09:31.773443+00:00", "command": [ "docker", "run", "--rm", "--entrypoint", "python", "--network", "none", "--read-only", "--user", "65534:65534", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "32", "--cpus", "1", "--memory", "512m", "-e", "PYTHONDONTWRITEBYTECODE=1", "--mount", "type=bind,src=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-sec-02\\current-source,dst=/capture,readonly", "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331", "/capture/capture_generation.py" ], "image": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331", "exitCode": 0, "sourceSha256": "9a4e7cca10572fcc2763c4b43016aee857ca3d5bb57f77ff7343f4bc0ca5b763", "timeoutSeconds": 60, "scope": "Second explicitly authorized read-only network-none static capture: generation implementation, no imports/inference/tests.", "priorAttempts": [ { "startedUtc": "2026-10-25T07:08:56.511369+00:00", "finishedUtc": "2026-10-25T07:08:57.293617+00:00", "command": [ "docker", "run", "--rm", "--entrypoint", "python", "--network", "none", "--read-only", "--user", "65534:65534", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "32", "--cpus", "1", "--memory", "512m", "-e", "PYTHONDONTWRITEBYTECODE=1", "--mount", "type=bind,src=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-sec-02\\current-source,dst=/capture,readonly", "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331", "/capture/capture_generation.py" ], "image": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331", "exitCode": 1, "sourceSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "timeoutSeconds": 60, "scope": "Second explicitly authorized read-only network-none static capture: generation implementation, no imports/inference/tests." } ] }, "generationSourceEvidence": [ { "path": "/usr/local/lib/python3.12/site-packages/transformers/generation/utils.py", "exists": true, "sha256": "ed15c08cee3c93f177da242308ad3151e2d95829a017e60c77c444f02984b603", "nanToNumCallTextOccurrences": 0, "matches": [ { "line": 82, "text": " InfNanRemoveLogitsProcessor," }, { "line": 721, "text": " position_ids = attention_mask.long().cumsum(-1) - 1" }, { "line": 760, "text": " attention_mask_from_padding = inputs_tensor.ne(pad_token_id).long()" }, { "line": 1198, "text": " if generation_config.remove_invalid_values is True:" }, { "line": 1199, "text": " processors.append(InfNanRemoveLogitsProcessor())" }, { "line": 1468, "text": " stacked_scores = torch.nn.functional.log_softmax(stacked_scores, dim=1)" }, { "line": 1473, "text": " max_beam_length = (1 - beam_indices_mask.long()).sum(-1).max()" }, { "line": 2039, "text": " def _valid_auto_compile_criteria(" }, { "line": 2052, "text": " valid_hardware = self.device.type in [\"cuda\", \"xpu\", \"neuron\", \"tpu\"] or bool(" }, { "line": 2053, "text": " generation_config.compile_config is not None and generation_config.compile_config._compile_all_devices" }, { "line": 2058, "text": " can_compile = valid_hardware and using_compilable_cache" }, { "line": 2643, "text": " input_ids = torch.where(input_ids == bos_token_id, pad_token_id, input_ids)" }, { "line": 2956, "text": " worst_finished_score = torch.where(is_sent_finished, torch.min(beam_scores, dim=1, keepdim=True)[0], -1.0e9)" }, { "line": 2962, "text": " def _beam_search_has_unfinished_sequences(" }, { "line": 3020, "text": " topk_log_probs, topk_indices = torch.topk(accumulated_log_probs, k=beams_to_keep)" }, { "line": 3023, "text": " topk_current_beam_indices = topk_indices // vocab_size" }, { "line": 3026, "text": " topk_ids = topk_indices % vocab_size" }, { "line": 3054, "text": " next_topk_indices = torch.topk(topk_running_log_probs, k=num_beams)[1]" }, { "line": 3106, "text": " topk_merged_indices = torch.topk(merged_scores, k=num_beams)[1]" }, { "line": 3115, "text": " def _beam_search(" }, { "line": 3278, "text": " model_outputs = self(**model_inputs, return_dict=True)" }, { "line": 3295, "text": " log_probs = nn.functional.log_softmax(logits, dim=-1)" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/generation/logits_process.py", "exists": true, "sha256": "e0b62e949a3510cac6d762ce7ac1968f2622ae01edb7a2ef7d555bff9da310cf", "nanToNumCallTextOccurrences": 0, "matches": [ { "line": 160, "text": " scores_processed = torch.where(eos_token_mask, -math.inf, scores)" }, { "line": 233, "text": " scores_processed = torch.where(eos_token_mask, -math.inf, scores)" }, { "line": 390, "text": " penalty_scores = torch.where(last_scores < 0, last_scores * self.penalty, last_scores / self.penalty)" }, { "line": 391, "text": " scores[0, last_positions, :] = torch.where(token_mask, penalty_scores, last_scores)" }, { "line": 402, "text": " penalty_scores = torch.where(last_scores < 0, last_scores * self.penalty, last_scores / self.penalty)" }, { "line": 403, "text": " scores[:, -1, :] = torch.where(token_mask, penalty_scores, last_scores)" }, { "line": 411, "text": " score = torch.where(score < 0, score * self.penalty, score / self.penalty)" }, { "line": 467, "text": " score = torch.where(score < 0, score * self.penalty, score / self.penalty)" }, { "line": 593, "text": " indices_to_remove = scores < torch.topk(scores, top_k)[0][..., -1, None]" }, { "line": 669, "text": " top_logits, top_idx = torch.topk(scores, top_n, dim=-1, largest=True, sorted=True)" }, { "line": 773, "text": " sorted_indices = torch.topk(probs, k, dim=-1).indices" }, { "line": 847, "text": " normalized = torch.nn.functional.log_softmax(scores, dim=-1)" }, { "line": 931, "text": " indices_to_remove = indices_to_remove & (scores < torch.topk(scores, top_k)[0][..., -1, None])" }, { "line": 1015, "text": " indices_to_remove = indices_to_remove & (scores < torch.topk(scores, top_k)[0][..., -1, None])" }, { "line": 1316, "text": " bias[:, last_token] += torch.where(" }, { "line": 1662, "text": "class InfNanRemoveLogitsProcessor(LogitsProcessor):" }, { "line": 1674, "text": " scores_processed = torch.where(scores != scores, 0.0, scores)" }, { "line": 1677, "text": " scores_processed = torch.where(scores == float(\"inf\"), torch.finfo(scores.dtype).max, scores_processed)" }, { "line": 1678, "text": " scores_processed = torch.where(scores == -float(\"inf\"), torch.finfo(scores.dtype).min, scores_processed)" }, { "line": 1817, "text": " scores_processed = scores.log_softmax(dim=-1)" }, { "line": 1869, "text": " scores_processed = torch.where(suppress_token_mask, -float(\"inf\"), scores)" }, { "line": 1910, "text": " scores = torch.where(suppress_token_mask, -float(\"inf\"), scores)" }, { "line": 2045, "text": " logprobs = torch.nn.functional.log_softmax(scores_processed.float(), dim=-1)" }, { "line": 2336, "text": " scores = torch.nn.functional.log_softmax(scores, dim=-1)" }, { "line": 2342, "text": " unconditional_logits = torch.nn.functional.log_softmax(logits[:, -1], dim=-1)" }, { "line": 2389, "text": " scores_processed = torch.where(do_early_stop, early_stop_scores, scores)" }, { "line": 2702, "text": " log_probs = torch.where(torch.isfinite(log_probs), log_probs, torch.finfo(log_probs.dtype).min)" }, { "line": 2761, "text": " updated_watermarked_scores = torch.where(" }, { "line": 3066, "text": " _, top_k_indices = torch.topk(scores_processed, k=self.guidance_top_k, dim=-1)" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/generation/configuration_utils.py", "exists": true, "sha256": "fa9997a5334fa132f2911f7518163d963a706a82ade7ebca78afce69bfdc3c39", "nanToNumCallTextOccurrences": 0, "matches": [ { "line": 242, "text": " remove_invalid_values (`bool`):" }, { "line": 244, "text": " Note that using `remove_invalid_values` can slow down generation." }, { "line": 410, "text": " self.remove_invalid_values = kwargs.pop(\"remove_invalid_values\", None)" }, { "line": 595, "text": " \"remove_invalid_values\": False," }, { "line": 1598, "text": " _compile_all_devices = None" }, { "line": 1602, "text": " return copy.deepcopy({key: value for key, value in self.__dict__.items() if key != \"_compile_all_devices\"})" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/generation/beam_search.py", "exists": false, "sha256": null, "nanToNumCallTextOccurrences": 0, "matches": [] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/models/bart/modeling_bart.py", "exists": true, "sha256": "8b2d998585a095967a72d27fc3f6ebe96c0e8b19256e7f22bb2577d98bc5885a", "nanToNumCallTextOccurrences": 0, "matches": [] }, { "path": "/app/app.py", "exists": true, "sha256": "aab24c7f64868fcb93a6133aa7b2087b23f98469e89e4c84fa040a022b0a8dfc", "nanToNumCallTextOccurrences": 0, "matches": [] } ], "numericScopeFalsifiers": [ "Any nan_to_num result cast to int64/long introduced into BART forward, generation/logits helpers or caller/custom processor.", "CPU graph compilation explicitly enabled, different native kernel path/quantization/backend/device used, or user tensor/model/processor graph input added.", "Evidence that the named upstream issue is reached by the exact preserved BART/logits/token-ID operations despite the absent chain." ], "qualificationCheckpoint": { "path": ".artifacts/p9-sec-02/qualification-checkpoint/result.json", "sha256": "7261a039c8acca3ccfd13b90a298640695f67d0d384184248463e691f725248a", "status": "PASS", "interpretation": "Existing bounded local compatibility evidence:59 sidecar tests, two synthetic-weight BART serialization paths using real pinned tokenizer,9 cache/negative/lock cases,5 parser/OCR cases and HTTP startup. These are not59+additional overlapping unit tests nor production/full-model qualification." }, "pinnedModelIdentity": { "repository": "sshleifer/distilbart-cnn-12-6", "revision": "a4f8f3ea906ed274767e9906dbaede7531d660ff", "referenceConfigSha256": "028d72a28b90a369eff3f99ceb585fbd2ababf070e8577d72c315757a49b8917", "modelType": "bart", "architecture": [ "BartForConditionalGeneration" ], "expectedFullCheckpointSha256": "3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea", "fullCheckpointPresent": false, "fullCheckpointExpectedBytes": 1222317369, "identityGap": "Pinned reference config/tokenizer verified; full checkpoint bytes are absent and actual hash/load/resources/semantic output remain unverified." }, "scopedNotAffectedCriteria": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ], "scopedNotAffectedIsLegitimateWithoutFullWeights": "Yes for named absent conversion scripts, removed Transformer-XL, excluded GLM4/Perceiver families and unused export.load API: full BART numeric weights cannot turn the fixed BART loader into those separate entry points under these scope conditions. Also justified for the precise55554 nan_to_num-to-long chain after capturing actual generation/logits/config source and excluding the chain; finite synthetic logits alone would not justify it.", "currentSourceEvidence": [ { "path": "/app/app.py", "exists": true, "sha256": "aab24c7f64868fcb93a6133aa7b2087b23f98469e89e4c84fa040a022b0a8dfc", "matches": [ { "line": 96, "text": "MODEL_NAME = \"sshleifer/distilbart-cnn-12-6\"" }, { "line": 98, "text": "MODEL_REVISION = \"a4f8f3ea906ed274767e9906dbaede7531d660ff\"" }, { "line": 164, "text": " tokenizer = AutoTokenizer.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False)" }, { "line": 165, "text": " model = AutoModelForSeq2SeqLM.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False, weights_only=True)" }, { "line": 166, "text": " model.eval()" }, { "line": 295, "text": " \"model\": MODEL_NAME," }, { "line": 519, "text": " with torch.no_grad():" }, { "line": 520, "text": " outputs = model.generate(" }, { "line": 1320, "text": "async def extract_text(file: UploadFile = File(...)):" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/models/auto/modeling_auto.py", "exists": true, "sha256": "0183af680a0922b24683fe63ecf3d120357247d473645f4834df6e22e2ff2f04", "matches": [ { "line": 535, "text": " (\"bart\", \"BartForConditionalGeneration\")," }, { "line": 1100, "text": " (\"bart\", \"BartForConditionalGeneration\")," }, { "line": 1219, "text": " (\"bart\", \"BartForConditionalGeneration\")," }, { "line": 2076, "text": "class AutoModelForSeq2SeqLM(_BaseAutoModelClass):" }, { "line": 2077, "text": " _model_mapping = MODEL_FOR_SEQ_TO_SEQ_CAUSAL_LM_MAPPING" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/models/auto/auto_factory.py", "exists": true, "sha256": "3e3b2bbb4c5219283d2df5e1686062496023d5d3ec09cd63aac808e675e0338c", "matches": [ { "line": 27, "text": "from ...dynamic_module_utils import get_class_from_dynamic_module, resolve_trust_remote_code" }, { "line": 140, "text": " trust_remote_code (`bool`, *optional*, defaults to `False`):" }, { "line": 208, "text": " trust_remote_code = kwargs.pop(\"trust_remote_code\", None)" }, { "line": 209, "text": " has_remote_code = hasattr(config, \"auto_map\") and cls.__name__ in config.auto_map" }, { "line": 214, "text": " if has_remote_code:" }, { "line": 220, "text": " trust_remote_code = resolve_trust_remote_code(" }, { "line": 221, "text": " trust_remote_code, config._name_or_path, has_local_code, has_remote_code, upstream_repo=upstream_repo" }, { "line": 224, "text": " if has_remote_code and trust_remote_code and not explicit_local_code:" }, { "line": 230, "text": " # This block handles the case where the user is loading a model with `trust_remote_code=True`" }, { "line": 240, "text": " model_class = _get_model_class(config, cls._model_mapping)" }, { "line": 266, "text": " trust_remote_code = kwargs.get(\"trust_remote_code\")" }, { "line": 356, "text": " has_remote_code = hasattr(config, \"auto_map\") and cls.__name__ in config.auto_map" }, { "line": 362, "text": " if has_remote_code:" }, { "line": 366, "text": " trust_remote_code = resolve_trust_remote_code(" }, { "line": 367, "text": " trust_remote_code," }, { "line": 370, "text": " has_remote_code," }, { "line": 373, "text": " kwargs[\"trust_remote_code\"] = trust_remote_code" }, { "line": 378, "text": " if has_remote_code and trust_remote_code and not explicit_local_code:" }, { "line": 383, "text": " # This block handles the case where the user is loading a model with `trust_remote_code=True`" }, { "line": 394, "text": " model_class = _get_model_class(config, cls._model_mapping)" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/models/bart/tokenization_bart.py", "exists": true, "sha256": "0e73c1fb692c6aad57297fb8202ea243e0797cf52c12b415ac33e7ff847b5fc0", "matches": [ { "line": 11, "text": "tokenizer as RoBERTa, so we expose `BartTokenizer` and `BartTokenizerFast`" }, { "line": 16, "text": "from ..roberta.tokenization_roberta import RobertaTokenizer as _RobertaTokenizer" }, { "line": 20, "text": "BartTokenizer = _RobertaTokenizer" }, { "line": 21, "text": "BartTokenizerFast = _RobertaTokenizer" }, { "line": 23, "text": "__all__ = [\"BartTokenizer\", \"BartTokenizerFast\"]" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/models/bart/modeling_bart.py", "exists": true, "sha256": "8b2d998585a095967a72d27fc3f6ebe96c0e8b19256e7f22bb2577d98bc5885a", "matches": [ { "line": 306, "text": " hidden_states = torch.clamp(hidden_states, min=-clamp_value, max=clamp_value)" }, { "line": 801, "text": "class BartForConditionalGeneration(BartPreTrainedModel, GenerationMixin):" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/transformers/modeling_utils.py", "exists": true, "sha256": "d6336507caf5fa4ea441934009d88c644a15640c6130084a72a20b64235f3ef8", "matches": [ { "line": 189, "text": " weights_only: bool = True" }, { "line": 337, "text": "def load_state_dict(" }, { "line": 340, "text": " weights_only: bool = True," }, { "line": 376, "text": " # Fallback to torch.load (if weights_only was explicitly False, do not check safety as this is known to be unsafe)" }, { "line": 377, "text": " if weights_only:" }, { "line": 384, "text": " return torch.load(checkpoint_path, map_location=map_location, weights_only=weights_only, **extra_args)" }, { "line": 827, "text": " weights_only: bool," }, { "line": 853, "text": " checkpoint_files[0], map_location=\"meta\", weights_only=weights_only" }, { "line": 3879, "text": " weights_only: bool = True," }, { "line": 4065, "text": " weights_only (`bool`, *optional*, defaults to `True`):" }, { "line": 4260, "text": " config, quantization_config, device_map, weights_only, user_agent" }, { "line": 4298, "text": " dtype, checkpoint_files, config, sharded_metadata, state_dict, weights_only, hf_quantizer" }, { "line": 4376, "text": " weights_only=weights_only," }, { "line": 4475, "text": " weights_only=load_config.weights_only," } ] }, { "path": "/usr/local/lib/python3.12/site-packages/torch/export/__init__.py", "exists": true, "sha256": "5a6382799fe55ec3a865c73a706348dccf6ebb81e11bc03a485420fed657c6aa", "matches": [ { "line": 283, "text": "def load(" }, { "line": 296, "text": " :func:`torch.export.load()` uses pickle under the hood to load models. **Never load data from an untrusted source.**" }, { "line": 340, "text": " from torch.export.pt2_archive._package import load_pt2, PT2ArchiveContents" }, { "line": 343, "text": " pt2_contents = load_pt2(" } ] }, { "path": "/usr/local/lib/python3.12/site-packages/torch/export/pt2_archive/_package.py", "exists": true, "sha256": "7d243aaaed0e9b613b96dc5addebd239b3d4fe5de46467b5dce591fb6560c0eb", "matches": [ { "line": 892, "text": " io.BytesIO(weight_bytes), weights_only=False" }, { "line": 950, "text": " io.BytesIO(constant_bytes), weights_only=False" }, { "line": 978, "text": " constants[constant_fqn] = pickle.loads(constant_bytes)" } ] } ], "modelInventoryEvidence": { "allPathsArtifact": ".artifacts/p9-sec-02/current-source/captured-source.json", "installedModelPythonFiles": 2159, "conversionPaths": [ "transformers/models/gemma4_unified/convert_gemma4_unified_weights.py" ], "transformerXlFiles": [], "glm4Present": true, "perceiverPresent": true, "seq2seqMappingContainsGlm4": false, "seq2seqMappingContainsPerceiver": false }, "scopeDispositionCounts": { "Not affected with evidence": 10 }, "accounting": "These10 groups are a subset of the existing44, themselves remaining from109 original =65 prior removals+44. Ten scoped non-applicability assessments are not ten newly vendor-patched CVEs, and no alias groups are dropped. Candidate graph zero provider matches must remain separate from these qualitative conclusions.", "remainingUncertainties": [ "CVE2025-55554 upstream open issue vs provider fixed event unresolved; no universal native numerical correctness or upstream patch proof.", "Exact functions for ZDI GLM4/Perceiver reports are not specified by refreshed primary text; exclusion is named-family/loader scope, not universal deserialization safety.", "No guarantee of new cache immutability or full-model SHA integrity from a pinned revision alone.", "No full1.22GB selected model inference, GPU, production or deployed artifact qualification.", "This lane did not make new provider queries; earlier captured vendor/OSV refresh is referenced." ], "advisories": [ { "groupId": "CVE-2025-55554", "identifiers": [ "BIT-pytorch-2025-55554", "CVE-2025-55554", "PYSEC-2025-206" ], "package": "torch", "function": "nan_to_num followed by .long numeric/compiler mismatch", "oldResearchDisposition": "Unresolved", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "Provider2.9 fixed event conflicts with open vendor issue; no global fix verified here.", "currentRuntimeVersion": "2.13.0+cpu", "installedLocator": "torch/_torch_docs.py", "actualServiceReachability": "Current BART forward, generation utils, logits processors and generation config sources contain ZERO nan_to_num calls. Beam search3278 invokes the model,3295 uses float log_softmax,3020 chooses topk indices,3023/3026 derive beam/token IDs by integer division/modulo; it does not cast sanitized float scores to long. Existing .long calls convert attention masks/beam masks, not nan_to_num results. CPU auto-compile criteria2052 exclude CPU unless explicit _compile_all_devices is configured; app passes no compile configuration. remove_invalid_values defaultsFalse and even its optional processor1674-1678 uses torch.where returning float scores, with no long cast.", "scopeLimit": "Upstream issue151510 remains open and no global fix is verified. Named operation chain is excluded from this exact CPU BART entry-point; this does not prove all native numerical code correct or full trained-model inference qualified.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc", "https://github.com/pytorch/pytorch/issues/151510" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-206", "retrievedUtc": "2026-10-25T06:30:29.565750+00:00", "status": 200, "sha256": "64f672cb98dbb7b9ef047f28dda45ac9a6c4336c8329dbf77b62dfbb172c4595", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-206-osv-50a92b9d.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2026-4538", "identifiers": [ "BIT-pytorch-2026-4538", "CVE-2026-4538", "PYSEC-2026-139" ], "package": "torch", "function": "torch.export.load .pt2 unsafe deserialization", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "2.13.0+cpu", "installedLocator": "torch/export", "actualServiceReachability": "Current2.13 export.load283 still calls load_pt2; pt2_archive/_package.py891-892 and949-950 explicitly load weights_only=False and978 calls pickle.loads. This is real retained unsafe functionality. App.from_pretrained uses Transformers load_state_dict337, whose .bin fallback384 calls torch.load(weights_only=weights_only); app explicitly supplies True. Neither app nor parser accepts .pt2 model uploads or calls export.load.", "scopeLimit": "Do not equate ordinary torch.load(.bin,weights_only=True) with torch.export.load(.pt2). No full checkpoint is needed to prove these distinct entry points; adding export/compile/package APIs invalidates the scoped exemption.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://github.com/pytorch/pytorch/", "https://github.com/pytorch/pytorch/pull/176791", "https://vuldb.com/?ctiid.352326", "https://vuldb.com/?id.352326", "https://vuldb.com/?submit.774681" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2026-139", "retrievedUtc": "2026-10-25T06:30:29.927389+00:00", "status": 200, "sha256": "e67ea61edf63c4185e0bd1bbd16bfe0962a7c9197a538d5cb30a3c1a5513b194", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2026-139-osv-434604ef.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14929", "identifiers": [ "CVE-2025-14929", "PYSEC-2025-217" ], "package": "transformers", "function": "X-CLIP checkpoint conversion", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "convert_x_clip_original_pytorch_to_hf.py", "actualServiceReachability": "Five named conversion CLIs are absent from the actual5.10 wheel, including X-CLIP. The sole installed conversion script is unrelated Gemma4. AutoModelForSeq2SeqLM.from_pretrained selects an existing BART class, not a conversion script. HTTP text/uploads cannot choose an X-CLIP checkpoint conversion command.", "scopeLimit": "Named script absent; no new global vendor fix claim.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-217", "https://www.zerodayinitiative.com/advisories/ZDI-25-1144/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-217", "retrievedUtc": "2026-10-25T06:30:30.374924+00:00", "status": 200, "sha256": "3adf5df151de0a18f3feadfd2650ba305d3f237118ed1b132f2e842257b1e49d", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-217-osv-ff71c1e4.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1144/", "retrievedUtc": "2026-10-25T06:30:30.509603+00:00", "status": 200, "sha256": "10b152510a354035579bbe5105a655b2d6ce68300b01b6986cf67713984d372d", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14929-vendor-4dd379a6.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14926", "identifiers": [ "CVE-2025-14926", "PYSEC-2025-214" ], "package": "transformers", "function": "SEW convert_config eval", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "convert_sew_original_pytorch_checkpoint_to_pytorch.py", "actualServiceReachability": "SEW conversion script is absent. BART model initialization does not run SEW convert_config, and the service accepts no converter/model-path arguments.", "scopeLimit": "Named script absent; arbitrary operator-installed conversion tooling is outside this image scope.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-214", "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-214", "retrievedUtc": "2026-10-25T06:30:30.673882+00:00", "status": 200, "sha256": "97107fe171dd25eab53fecd583360fe9ce08a47076accf5200e085abd645fde1", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-214-osv-b2482d71.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/", "retrievedUtc": "2026-10-25T06:30:30.686526+00:00", "status": 200, "sha256": "6d707a24d8e132cf52688fedbc0b8b9e132cf5c6432e35e85ac3f2cb8563692f", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14926-vendor-445e796e.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14930", "identifiers": [ "CVE-2025-14930", "PYSEC-2025-218" ], "package": "transformers", "function": "GLM4 weight parsing/deserialization", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "glm4", "actualServiceReachability": "Unlike4.48.3, GLM4 modules are present in5.10. Its Glm4ForCausalLM maps to a different AutoModel family; GLM4 is absent from the seq2seq mapping. Verified pinned config declares model_type=bart and BartForConditionalGeneration. Request text cannot change config/model family.", "scopeLimit": "Do not claim GLM4 code is absent or globally fixed. ZDI does not identify a precise loader function; conclusion is family/entry-point separation only.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-218", "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-218", "retrievedUtc": "2026-10-25T06:30:30.806213+00:00", "status": 200, "sha256": "ed2ea88b7e2a423d042ff44b2fc8678373c846ed89b52174d8f3a80001e30b6c", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-218-osv-b3d3148b.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/", "retrievedUtc": "2026-10-25T06:30:30.977097+00:00", "status": 200, "sha256": "bd9c6966ace3e07e059e46e2e475d2a35e9b31b8d219692c1e8d25ca6ed3bbc9", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14930-vendor-174b1aa2.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14920", "identifiers": [ "CVE-2025-14920", "PYSEC-2025-211" ], "package": "transformers", "function": "Perceiver model-file deserialization", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "perceiver", "actualServiceReachability": "Perceiver modules remain installed. Perceiver appears in generic/masked-LM/classification mappings, but not AutoModelForSeq2SeqLM mapping. Verified pinned BART config selects BART. BART tokenizer/generate do not dispatch Perceiver model parsing.", "scopeLimit": "ZDI mechanism is broad; the scoped finding excludes its named architecture, not all deserialization. Shared torch.load boundary is separately patched/qualified, never assumed harmless.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-211", "https://www.zerodayinitiative.com/advisories/ZDI-25-1150/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-211", "retrievedUtc": "2026-10-25T06:30:30.981107+00:00", "status": 200, "sha256": "b1ad7651e401afe2f018a894233927f5e3ffc74713eff8c92f9b67010506c915", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-211-osv-46b72aed.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1150/", "retrievedUtc": "2026-10-25T06:30:31.016057+00:00", "status": 200, "sha256": "29ee25a4f04f0c1dcd8f7c8d726f0709a189ce4fc685f0e69dff0a581f740795", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14920-vendor-0db1197c.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14921", "identifiers": [ "CVE-2025-14921", "PYSEC-2025-212" ], "package": "transformers", "function": "Transformer-XL tokenizer/model pickle loading", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "transfo_xl", "actualServiceReachability": "Actual5.10 installed model inventory contains no transfo_xl package/files. The old4.48.3 unsafe TransfoXL tokenizer path no longer exists. Selected tokenizer implementation is BART/RoBERTa backend, not a pickle vocabulary tokenizer.", "scopeLimit": "Code removal from this wheel is direct current-source evidence; it does not establish an upstream CVE patch release for every distribution.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-212", "https://www.zerodayinitiative.com/advisories/ZDI-25-1149/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-212", "retrievedUtc": "2026-10-25T06:30:31.278789+00:00", "status": 200, "sha256": "4ddc0cacf64df0a185a7f9ed7efd8ab925f47415e7a5d16ef6c0cfe46f39c175", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-212-osv-46f45372.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1149/", "retrievedUtc": "2026-10-25T06:30:31.328648+00:00", "status": 200, "sha256": "ad3fe799fe57f7ca2c4f6801b73909ad04f6e18df1605f414e29072c99bfa69c", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14921-vendor-f87260aa.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14924", "identifiers": [ "CVE-2025-14924", "PYSEC-2025-213" ], "package": "transformers", "function": "Megatron-GPT2 checkpoint conversion", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "convert_megatron_gpt2_checkpoint.py", "actualServiceReachability": "Megatron conversion script is absent from5.10 wheel. Fixed BART loader consumes standard weights, not converter CLI inputs or Megatron checkpoint arguments.", "scopeLimit": "General BART .bin loading still uses torch.load; this is a distinct patched weights_only boundary and not a Megatron conversion exemption for all code.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-213", "https://www.zerodayinitiative.com/advisories/ZDI-25-1141/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-213", "retrievedUtc": "2026-10-25T06:30:31.559012+00:00", "status": 200, "sha256": "0ba1b14fb5c727d9941c5df62d97d5cb8a7407e0af2fcc7e8bad140d2a945f6f", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-213-osv-e1a15253.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1141/", "retrievedUtc": "2026-10-25T06:30:31.849765+00:00", "status": 200, "sha256": "14c885de463b5256fb9045a97c1025b906961eeedd8006043fcded26a1f5d25e", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14924-vendor-6bff1021.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14927", "identifiers": [ "CVE-2025-14927", "PYSEC-2025-215" ], "package": "transformers", "function": "SEW-D convert_config eval", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "convert_sew_d_original_pytorch_checkpoint_to_pytorch.py", "actualServiceReachability": "SEW-D conversion script absent. Auto seq2seq BART loader and request text do not invoke SEW-D convert_config or execute user conversion strings.", "scopeLimit": "Reassess if conversion tooling or audio-model support added.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-215", "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-215", "retrievedUtc": "2026-10-25T06:30:32.212243+00:00", "status": 200, "sha256": "2980168df942462a444385ba8b6fedb3a98ccd7b1173fd0b8ab0bdc49e70f3ea", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-215-osv-5acad121.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/", "retrievedUtc": "2026-10-25T06:30:32.407304+00:00", "status": 200, "sha256": "ff54a2f77f12e400ef72769849797a9300c0d2e54520bdbbf26430bab9c78fec", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14927-vendor-a5b776ab.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." }, { "groupId": "CVE-2025-14928", "identifiers": [ "CVE-2025-14928", "PYSEC-2025-216" ], "package": "transformers", "function": "HuBERT convert_config eval", "oldResearchDisposition": "No fix", "currentScopedDisposition": "Not affected with evidence", "upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.", "currentRuntimeVersion": "5.10.0", "installedLocator": "convert_hubert_original_pytorch_checkpoint_to_pytorch.py", "actualServiceReachability": "HuBERT conversion script absent. App exposes fixed BART text generation and separate PIL/Tesseract/pypdf extraction; no HuBERT audio conversion route.", "scopeLimit": "No global vendor fix claim; boundary is named converter absence plus fixed BART dispatch.", "scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.", "confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.", "primaryAdvisorySources": [ "https://osv.dev/vulnerability/PYSEC-2025-216", "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/" ], "priorRefreshEvidence": [ { "url": "https://api.osv.dev/v1/vulns/PYSEC-2025-216", "retrievedUtc": "2026-10-25T06:30:32.498018+00:00", "status": 200, "sha256": "260b9ce87788db46ff1336dc4ae59474da75dbd673c5ca779ef20487d22123bb", "contentType": "application/json", "file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-216-osv-a41da499.raw" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/", "retrievedUtc": "2026-10-25T06:30:32.737570+00:00", "status": 200, "sha256": "5baa635ef760b47a023eb0332811f4b041403bac722c7d4202a59cd8c9c9c4de", "contentType": "text/html; charset=utf-8", "file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14928-vendor-f5b408f5.raw" } ], "publishedSeverityLabels": [], "severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.", "reopenWhen": [ "Model repository/revision/family, tokenizer class, runtime image or package wheel changes.", "New conversion/export/PT2/native graph input accepted.", "Untrusted caller can alter loader kwargs, config, package files or model cache." ], "verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix." } ] }