# P9-SEC-02 advisory research
Read-only source assessment; **no runtime compatibility or production acceptance claimed**. All44 remaining groups are assessed individually in [advisory-research.json](advisory-research.json). The JSON retains original alias IDs, affected ranges, fixed events, severity/vector, refreshed primary evidence, installed paths/hashes, input reachability, mitigation/residual, compatibility risks and required tests. Root qualification owns final dispositions.
## Accounting
109 original alias groups =65 previously removed +44 researched here (filelock3, torch19, Transformers22). The earlier249→99 provider-record counts are retained and are not distinct vulnerability counts. This lane adds zero runtime/model qualification passes. No owner acceptance.
## Minimal candidate graph and compatibility gates
- filelock4.2.1 addresses all three published filelock ranges. Qualify native and soft fallback lock ownership, contention/stale markers and finite timeouts on Windows and Linux; shared writable cache permissions are not established here.
- torch2.13.0+cpu is the smallest published all-fixable-record bound because JIT CVE-2025-3000 remains affected through2.12.1. The vendor CPU index advertises cp312 Windows amd64 and manylinux_2_28 x86_64 wheels. Use those CPU identities, not the PyPI generic Linux wheel that requires CUDA13. Actual wheel/import/inference qualification is pending.
- Transformers5.10.0 is the latest first-patched bound among these records (chat-template save traversal). Its base metadata requires huggingface-hub>=1.5,<2, tokenizers>=0.22,<=0.23, regex>=2025.10.22 and typer; current installed hub0.36.2/tokenizers0.21.4 cannot stay pinned. Resolve/hash the graph in isolation and preserve the65 prior remediations. Tagged5.10 source still has AutoModelForSeq2SeqLM and BART mapping; that is not import/inference proof.
- These versions do not establish closure of all44: eight ZDI conversion/deserialization groups and torch.pt2 have no verified release fix. CVE-2025-55554 has a still-open vendor issue despite a provider2.9 fix event. Never claim a fully safe graph from maximum version arithmetic alone.
Candidate metadata: [filelock](https://pypi.org/pypi/filelock/4.2.1/json), [torch](https://pypi.org/pypi/torch/2.13.0/json), [Transformers](https://pypi.org/pypi/transformers/5.10.0/json), [vendor CPU index](https://download.pytorch.org/whl/cpu/torch/).98 distinct source responses retained: first54-request vendor/security batch succeeded, then all44 OSV refreshes succeeded.12 repeated GitHub API requests hit rate limits; initial successful raw bodies remain, with captured-file mtime explicitly distinguished from HTTP retrieval timestamps. Exact URLs, hashes and repeat errors are in `.artifacts/p9-sec-02/advisory-research/refresh-index.json`.
## Actual service path and limits
`app.py:161` loads fixed-name AutoTokenizer/AutoModelForSeq2SeqLM, calls eval, then tokenizer truncation1024 → no_grad → generate with3 beams → decode. Installed Auto mappings select BartTokenizer/Fast and BartForConditionalGeneration for a BART config. BART layers are attention/linear/norm; dropout exists but eval disables training dropout. This differs from LSTM, CTC, image pooling, sparse graphs, JIT/Inductor, TensorFlow optimizers and conversion CLIs. The parser child handles uploads via pypdf/Pillow/Tesseract, not Donut/Transformers video/CTC.
The actual serialized config/checkpoint remains a separate trust boundary: no immutable model revision or manifest is supplied by app.py; safetensors is not required. Installed Transformers load_state_dict493 reaches torch.load535 for non-safetensors files with weights_only=True. That flag does not protect torch2.6 from CVE-2026-24747. Do not dismiss loader risk just because app.py lacks a direct torch.load call. Fixed model name is not artifact integrity.
Installed source fingerprints are preserved in `installed-source-matches.json`; no Python model modules were imported. Windows METADATA reports torch2.6.0 rather than locked2.6.0+cpu. Installed model tree has no conversion scripts and no LightGlue implementation; these facts qualify specific paths and do not clear the entire package. Current4.48.3 attention selection rejects arbitrary repository strings; CVE-2026-4372 still needs an introduction/fix or safe negative regression before a definitive exemption.
## Individual alias groups
Disposition is scoped to the current inspected service, and does not silently remove matching package records. “Fix available but blocked by compatibility” means qualification is pending, not that a failed compatibility test occurred. Published severities remain unchanged.
| Group / all aliases | Vulnerable function and installed locator | Range → patch | Service reachability and residual | Disposition |
| --- | --- | --- | --- | --- |
| [CVE-2026-112940](https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8)
GHSA-v4x8-3wr5-3wq8 | ReadWriteLock SQLite database reopen and POSIX symlink/side-file handling
`tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py` | >= 3.20.4, <= 4.2.0 → 4.2.1 | SQLite-backed ReadWriteLock is a different lock type from Hub WeakFileLock; installed Hub _fixes.py constructs FileLock then SoftFileLock. Remote document text cannot choose lock type or database filename. No ReadWriteLock application import/call. Scoped service lock selection excludes this SQLite API; package remains in affected range. Reassess if reader/writer locks are introduced. | Not affected with evidence |
| [CVE-2026-112913](https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5)
GHSA-9vhv-jxww-xfm5 | ReadWriteLock Windows SQLite -wal/-journal/-shm handling
`tools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py` | >= 3.20.4, <= 4.2.0 → 4.2.1 | Requires local attacker-created SQLite side files in shared writable directory. Current cache helper uses native FileLock or SoftFileLock, not SQLite ReadWriteLock; parser has no filelock import. Service call graph excludes ReadWriteLock, not all uses of filelock. Cache directory permissions are not claimed verified. | Not affected with evidence |
| [CVE-2026-112907](https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92)
GHSA-567q-5qvw-pf92 | SoftFileLock marker open/stale breaking on Windows oplock
`tools/summarizer/.venv/Lib/site-packages/filelock/_soft.py` | >= 3.22.0, <= 4.2.0 → 4.2.1 | Hub WeakFileLock fallback reaches SoftFileLock; filelock native lock can also fall back. Local user able to open cache marker can stall open beyond timeout. Cannot dismiss using HTTP request limits or parser child timeout. Upgrade filelock4.2.1; qualify native/fallback lock contention, stale marker and finite timeout on Windows and Linux. Existing source checks do not prove ACL isolation. | Fix available but blocked by compatibility |
| [CVE-2025-3001](https://github.com/advisories/GHSA-qfhq-4f3w-5fph)
BIT-pytorch-2025-3001, GHSA-qfhq-4f3w-5fph, PYSEC-2025-195 | torch.lstm_cell / native LSTM cell tensor validation
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/rnn.py` | < 2.10.0 → 2.10.0 | Installed LSTMCell forwards to _VF.lstm_cell. BART decoder uses attention, linear and layer norms, not recurrent LSTMCell. Request text becomes bounded token IDs, not arbitrary tensor dimensions or Python graphs. BART architecture excludes LSTM operation; native wheel and future architectures remain vulnerable until patched. | Mitigated with residual risk |
| [CVE-2025-3000](https://github.com/advisories/GHSA-rrmf-rvhw-rf47)
BIT-pytorch-2025-3000, GHSA-rrmf-rvhw-rf47, PYSEC-2025-194 | torch.jit.script compilation
`tools/summarizer/.venv/Lib/site-packages/torch/jit/_script.py` | <= 2.12.1 → 2.13.0 | Application does not call script or torch.compile; model loader creates Python BART class and generate uses eager no_grad. Text cannot submit Python source or choose a compiled graph. Third-party optional branches/native internals are not runtime qualified. 2.13.0 is current published first patch; synthetic eager tests alone cannot prove selected checkpoint inference compatibility. | Fix available but blocked by compatibility |
| [CVE-2025-2999](https://github.com/advisories/GHSA-vgrw-7cvw-pwgx)
BIT-pytorch-2025-2999, GHSA-vgrw-7cvw-pwgx, PYSEC-2025-193 | torch.nn.utils.rnn.unpack_sequence
`tools/summarizer/.venv/Lib/site-packages/torch/nn/utils/rnn.py` | < 2.9.1 → 2.9.1 | BART accepts padded input_ids plus attention_mask and does not construct PackedSequence or unpack_sequence; malicious tensor metadata is not an HTTP input. Different RNN API; retain affected-package finding until patched or scoped owner decision. | Mitigated with residual risk |
| [CVE-2025-2953](https://github.com/advisories/GHSA-3749-ghw9-m3mg)
BIT-pytorch-2025-2953, GHSA-3749-ghw9-m3mg, PYSEC-2025-191 | torch.mkldnn_max_pool2d
`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | < 2.7.1-rc1 → 2.7.1-rc1 | Vendor names mkldnn_max_pool2d. BART attention/linear architecture contains no image/max-pooling layer. Raw image bytes go to separate OCR parser; they are not passed as model tensor graphs. No selected BART max-pooling path identified; local arbitrary Python remains outside HTTP boundary. | Mitigated with residual risk |
| [CVE-2025-46148](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46148, PYSEC-2025-198 | nn.PairwiseDistance(p=2), eager/Inductor inconsistent result
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/distance.py` | Prior provider events → 2.7.0; exact ranges in JSON | Installed PairwiseDistance wrapper exists; BART/generate path does not compute pairwise distances. Vendor issue describes numeric correctness, not a demonstrated remotely supplied model graph. Architectural separation reduces service exposure; provider range and severity retained without claiming native safety. | Mitigated with residual risk |
| [CVE-2025-46149](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46149, PYSEC-2025-199 | nn.Fold Inductor code generation assertion
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/fold.py` | Prior provider events → 2.7.0; exact ranges in JSON | Fold constructs image blocks; BART text inference has no Fold and does not call torch.compile or Inductor. Requires a different operation and compiler route; preserve scanner finding until package patch. | Mitigated with residual risk |
| [CVE-2025-46150](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46150, PYSEC-2025-200 | FractionalMaxPool2d torch.compile correctness
`tools/summarizer/.venv/Lib/site-packages/torch/nn/modules/pooling.py` | Prior provider events → 2.7.0; exact ranges in JSON | No FractionalMaxPool2d in selected BART layers; application performs eager eval generation without compilation. Model graph cannot be supplied through text; unqualified optional/native branches remain residual. | Mitigated with residual risk |
| [CVE-2025-46152](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46152, PYSEC-2025-201 | bitwise_right_shift boundary shift in Inductor
`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/codegen/cpp.py` | Prior provider events → 2.7.0; exact ranges in JSON | Vendor issue concerns compiled out-of-range shift count. Application accepts text, no arbitrary shift operand/compiler graph; selected BART layer source has no bitwise_right_shift. Eager BART separation; not a claim that every installed tensor operation is fixed. | Mitigated with residual risk |
| [CVE-2025-46153](https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a)
BIT-pytorch-2025-46153, PYSEC-2025-202 | bernoulli_p decomposition, fallback_random, Dropout1d/2d/3d
`tools/summarizer/.venv/Lib/site-packages/torch/_decomp/decompositions.py` | Prior provider events → 2.7.0; exact ranges in JSON | BART contains functional.dropout, so merely saying no dropout would be false. model.eval() disables training dropout; app does not enable Inductor fallback_random nor spatial Dropout1d/2d/3d. Vendor source points to Inductor fallback; old summary says before3.7.0 while range fixes2.7.0. Preserve discrepancy and use exact provider events, not guessed3.7 pin. | Mitigated with residual risk |
| [CVE-2025-55551](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55551, PYSEC-2025-203 | torch.linalg.lu with slicing in Inductor/AOT
`tools/summarizer/.venv/Lib/site-packages/torch/linalg/__init__.py` | Prior provider events → 2.9.0; exact ranges in JSON | Vendor issue contrasts compiled/AOT and eager LU slicing. BART attention does not perform LU decomposition and application has no compile/AOT route. Published range includes2.6 though issue title mentions2.8; no suppression solely from version in prose. | Mitigated with residual risk |
| [CVE-2025-55552](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55552, PYSEC-2025-204 | torch.rot90 and randn_like compiled graph
`tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py` | Prior provider events → 2.9.0; exact ranges in JSON | BART does not rotate image tensors or compile rot90/randn_like graphs. Text token IDs cannot select these APIs. Vendor issue is compiler/eager mismatch; package severity remains source-reported. | Mitigated with residual risk |
| [CVE-2025-55553](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55553, PYSEC-2025-205 | proxy_tensor.py tracing .random_ syntax error
`tools/summarizer/.venv/Lib/site-packages/torch/fx/experimental/proxy_tensor.py` | Prior provider events → 2.7.1; exact ranges in JSON | Proxy tensor tracing/compiler route, not ordinary BART no_grad eager generation. Application exposes no graph tracing or caller-defined modules. No compiled tracing request boundary identified; changing execution mode needs new review. | Mitigated with residual risk |
| [CVE-2025-55554](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55554, PYSEC-2025-206 | torch.nan_to_num then long edge-case numeric conversion
`tools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py` | Prior provider events → 2.9.0; exact ranges in JSON | Selected BART source has no nan_to_num().long() chain. Vendor issue remains open despite provider2.9.0 fix event; report does not infer closed/resolved from version metadata. Provider patch claim conflicts with still-open vendor issue. Need fix-commit/reproducer confirmation before Fixed verified. | Unresolved |
| [CVE-2025-55557](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55557, PYSEC-2025-207 | Inductor compiled cummin Triton NameError
`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py` | Prior provider events → 2.7.1; exact ranges in JSON | Selected BART attention and beam generation do not call compiled cummin; eager app supplies token text and uses CPU baseline rather than authored Triton kernels. Architectural reduction only; CPU and CUDA selection still require candidate qualification. | Mitigated with residual risk |
| [CVE-2025-55558](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55558, PYSEC-2025-208 | Inductor Conv2d/hardshrink/view/mv compiler failure
`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | Prior provider events → 2.7.1; exact ranges in JSON | Vendor issue reports CppCompileError while scanner summary calls buffer overflow. BART is text attention/linear model, lacks this Conv2d/hardshrink chain, and app does not compile. Retain source disagreement; no security downgrade justified merely by compiler error title. | Mitigated with residual risk |
| [CVE-2025-55560](https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc)
BIT-pytorch-2025-55560, PYSEC-2025-209 | Inductor to_sparse/to_dense lowering
`tools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py` | Prior provider events → 2.7.1; exact ranges in JSON | BART does not create sparse model inputs and app does not enable Inductor. Sparse tensor graph cannot be submitted through summarize text. Package remains affected according to provider; graph separation is a mitigation, not patch proof. | Mitigated with residual risk |
| [CVE-2026-4538](https://github.com/pytorch/pytorch/)
BIT-pytorch-2026-4538, PYSEC-2026-139 | torch.export.load .pt2 deserialization
`tools/summarizer/.venv/Lib/site-packages/torch/export/__init__.py` | Prior provider events → no published fix; exact ranges in JSON | Installed export.load API exists but Transformers load_state_dict uses safetensors or torch.load, not export.load. Neither app nor parser accepts .pt2 or model uploads. Fixed repository alone does not establish checkpoint integrity. No published fixed release in baseline ranges. Vendor PR176791 closed without merged_at; proposal requires explicit weights_only=True and cannot establish released patch. No export.load in service path. | No fix |
| [CVE-2025-3730](https://github.com/advisories/GHSA-887c-mr87-cxwp)
BIT-pytorch-2025-3730, GHSA-887c-mr87-cxwp, PYSEC-2026-1970 | torch.nn.functional.ctc_loss / native LossCTC
`tools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py` | <= 2.7.1 → 2.8.0 | Vendor identifies CTC loss; service invokes BARTForConditionalGeneration.generate without labels, training or CTC. OCR uses Tesseract in parser child, not torch CTC. Specific alternate loss API, not generic model-resource bug. No inference/native compatibility PASS asserted. | Mitigated with residual risk |
| [CVE-2026-24747](https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p)
BIT-pytorch-2026-24747, GHSA-63cw-57p8-fm3p, PYSEC-2026-1856, PYSEC-2026-2286 | torch.load(weights_only=True) unpickler memory corruption
`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py` | < 2.10.0 → 2.10.0 | Actual installed load_state_dict493 forwards non-safetensors checkpoints to torch.load535 with weights_only=True. app.from_pretrained does not require safetensors or pin revision; therefore malicious or compromised model/cache checkpoint can reach vulnerable loader even though no direct app torch.load exists. Upgrade torch>=2.10 minimum for this issue; full published graph needs2.13.0. Require immutable revision, actual artifact format/hashes and benign inference. weights_only=True is not sufficient mitigation on2.6. | Fix available but blocked by compatibility |
| [CVE-2025-14929](https://osv.dev/vulnerability/PYSEC-2025-217)
PYSEC-2025-217 | X-CLIP checkpoint conversion unsafe deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/x_clip/convert_x_clip_original_pytorch_to_hf.py` | Prior provider events → no published fix; exact ranges in JSON | Installed wheel contains no *convert* files under transformers/models. BART auto model selection does not run X-CLIP conversion CLI; service accepts no checkpoint conversion arguments. Refreshed ZDI1144 still provides restriction mitigation, no patched version. Absent conversion script and fixed service route reduce exposure; no all-version package exemption. | No fix |
| [CVE-2025-2099](https://github.com/advisories/GHSA-qq3j-4f4f-9583)
GHSA-qq3j-4f4f-9583, PYSEC-2025-40 | testing_utils.preprocess_string doctest ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/testing_utils.py` | < 4.50.0 → 4.50.0 | Installed2593 preprocess_string processes Python/Markdown doctest contents. App tokenizer does not use testing_utils; CV text/Markdown uploads go through parser normalization, not doctest preparation. Different function/input ownership; use4.50.0 current GHSA first patch rather than ambiguous prior4.49 event. | Not affected with evidence |
| [CVE-2025-14926](https://osv.dev/vulnerability/PYSEC-2025-214)
PYSEC-2025-214 | SEW conversion convert_config string eval
`tools/summarizer/.venv/Lib/site-packages/transformers/models/sew/convert_sew_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | Conversion script is absent from installed models tree; BART inference has no SEW conversion or checkpoint argument input. ZDI1147 refreshed report remains0-day with no release patch. Do not add conversion capability; arbitrary model files remain untrusted. | No fix |
| [CVE-2025-14930](https://osv.dev/vulnerability/PYSEC-2025-218)
PYSEC-2025-218 | GLM4 weights parsing unsafe deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/glm4` | Prior provider events → no published fix; exact ranges in JSON | No glm4 directory in installed4.48.3; selected mapping is BART, not GLM4. Advisory version range broader than named architecture availability; no assumption newest release fixes this. ZDI1145 still has no fixed version. Keep identity check for actual config; upgrading can introduce new architecture code. | No fix |
| [CVE-2025-14920](https://osv.dev/vulnerability/PYSEC-2025-211)
PYSEC-2025-211 | Perceiver model conversion/deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/perceiver` | Prior provider events → no published fix; exact ranges in JSON | Perceiver model package exists but no conversion scripts are installed. AutoModelForSeq2SeqLM maps bart to BartForConditionalGeneration; Perceiver has distinct model/configuration and tokenizer modules. No model upload endpoint. ZDI1150 no fix; actual Perceiver entry-point identity not published by ZDI beyond parsing. Treat family restriction as scoped mitigation rather than proven whole-package absence. | No fix |
| [CVE-2025-14921](https://osv.dev/vulnerability/PYSEC-2025-212)
PYSEC-2025-212 | Transformer-XL tokenizer/model pickle deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py` | Prior provider events → no published fix; exact ranges in JSON | Installed TransfoXL tokenizer explicitly contains pickle.load and warns/deprecates unsafe loading. BartTokenizer/BartTokenizerFast map uses JSON vocab/merges and byte BPE; no Transformer-XL vocab accepted by service. ZDI1149 no fixed release; dangerous API does exist. Architecture selection and no vocab upload reduce reachability; trust actual config identity before stronger verdict. | No fix |
| [CVE-2025-14924](https://osv.dev/vulnerability/PYSEC-2025-213)
PYSEC-2025-213 | megatron_gpt2 checkpoint conversion deserialization
`tools/summarizer/.venv/Lib/site-packages/transformers/models/megatron_gpt2/convert_megatron_gpt2_checkpoint.py` | Prior provider events → no published fix; exact ranges in JSON | Conversion scripts absent in installed models tree; selected BART loader uses standard load_state_dict, not Megatron conversion. General torch.load checkpoint risk tracked separately under24747. ZDI1141 says vendor declined changes; no patched version. Do not treat newer Transformers as closing this record without evidence. | No fix |
| [CVE-2025-14927](https://osv.dev/vulnerability/PYSEC-2025-215)
PYSEC-2025-215 | SEW-D convert_config eval
`tools/summarizer/.venv/Lib/site-packages/transformers/models/sew_d/convert_sew_d_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | SEW-D conversion source absent from installed wheel. HTTP summarize does not expose conversion/config strings or select audio model families. ZDI1148 no fix; fixed model family is mitigation, not universal library safety. | No fix |
| [CVE-2025-14928](https://osv.dev/vulnerability/PYSEC-2025-216)
PYSEC-2025-216 | HuBERT convert_config eval
`tools/summarizer/.venv/Lib/site-packages/transformers/models/hubert/convert_hubert_original_pytorch_checkpoint_to_pytorch.py` | Prior provider events → no published fix; exact ranges in JSON | HuBERT conversion source absent from installed wheel; BART tokenizer/model path does not invoke audio conversion. ZDI1146 no release patch. Retain record rather than infer upgrade clears it. | No fix |
| [CVE-2025-3933](https://github.com/advisories/GHSA-37mw-44qp-f5jm)
GHSA-37mw-44qp-f5jm, PYSEC-2026-1977 | DonutProcessor.token2json ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/donut/processing_donut.py` | <= 4.51.3 → 4.52.1 | Actual Donut token2json regex exists in separate processor. Service document OCR invokes Tesseract/Pillow, never DonutProcessor; BART decode returns text without token2json. Explicit different document-processing owner avoids confusing OCR with Donut; installed affected API remains. | Mitigated with residual risk |
| [CVE-2025-6638](https://github.com/advisories/GHSA-59p9-h35m-wg4g)
GHSA-59p9-h35m-wg4g, PYSEC-2026-1981 | MarianTokenizer.remove_language_code ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/marian/tokenization_marian.py` | < 4.53.0 → 4.53.0 | Marian tokenizer removes language codes; BART maps to BartTokenizer/Fast with separate vocab/merges byte BPE. Request text cannot select Marian tokenizer. Architecture-specific tokenizer; validate actual model/tokenizer config before full Not affected claim. | Mitigated with residual risk |
| [CVE-2025-3264](https://github.com/advisories/GHSA-jjph-296x-mrcr)
GHSA-jjph-296x-mrcr, PYSEC-2026-1985 | dynamic_module_utils.get_imports Python-source regex
`tools/summarizer/.venv/Lib/site-packages/transformers/dynamic_module_utils.py` | < 4.51.0 → 4.51.0 | Installed141 get_imports reads Python code. Auto factory540 executes dynamic module path only for has_remote_code and resolved trust_remote_code. Current app does not opt in, BART has local implementation; missing immutable artifact/config identity prevents universal dispatch proof. Fix4.51.0; upgrade candidate5.10.0. Explicitly deny remote code and qualify loader; do not conflate regex input with ordinary request text. | Fix available but blocked by compatibility |
| [CVE-2025-1194](https://github.com/advisories/GHSA-fpwr-67px-3qhx)
GHSA-fpwr-67px-3qhx, PYSEC-2026-1984 | SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py` | < 4.50.0 → 4.50.0 | Named GPT-NeoX-Japanese tokenizer exists as separate implementation; selected BART tokenizer uses byte BPE, not SubWordJapaneseTokenizer. Text cannot select tokenizer class directly. Do not label all tokenization ReDoS reachable merely because service tokenizes; actual family/config still needs identity. | Mitigated with residual risk |
| [CVE-2025-3777](https://github.com/advisories/GHSA-phhr-52qp-3mj4)
GHSA-phhr-52qp-3mj4, PYSEC-2026-1986 | image_utils video URL username validation
`tools/summarizer/.venv/Lib/site-packages/transformers/image_utils.py` | < 4.52.1 → 4.52.1 | Installed4.48.3 image_utils has load_image (HTTP image URL) but no load_video/YouTube helper; video_utils.py is absent. BART receives text only; uploaded image bytes handled by PIL/Tesseract in parser, never a Transformers media URL helper. No Transformers video/YouTube URL input route. CV text containing a URL is text, not automatically dereferenced by this helper. | Not affected with evidence |
| [CVE-2025-6051](https://github.com/advisories/GHSA-rcv9-qm8p-9p6j)
GHSA-rcv9-qm8p-9p6j, PYSEC-2026-1988 | CLVP EnglishNormalizer.normalize_numbers ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/models/clvp/number_normalizer.py` | < 4.53.0 → 4.53.0 | Actual normalize_numbers197 is CLVP text/audio normalizer; selected BART tokenizer has no EnglishNormalizer call. This is not generic normalize_text in parser_child.py. Keep distinct normalization owners and architecture scopes; model identity qualification remains needed. | Mitigated with residual risk |
| [CVE-2025-6921](https://github.com/advisories/GHSA-4w7r-h757-3r74)
GHSA-4w7r-h757-3r74, PYSEC-2026-1980 | AdamWeightDecay._do_use_weight_decay user regex
`tools/summarizer/.venv/Lib/site-packages/transformers/optimization_tf.py` | < 4.53.0 → 4.53.0 | TensorFlow training optimizer branch. Service performs torch.no_grad model.eval generation; no optimizer, training patterns or TensorFlow model conversion requested. No optimizer input boundary or training invocation; tensor generation length controls do not constitute the mitigation. | Not affected with evidence |
| [CVE-2025-3263](https://github.com/advisories/GHSA-q2wp-rjmx-x6x9)
GHSA-q2wp-rjmx-x6x9, PYSEC-2026-1987 | configuration_utils.get_configuration_file ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/configuration_utils.py` | < 4.51.0 → 4.51.0 | Installed1134 function consumes configuration_files list from model config in shared from_pretrained path. Fixed repository name reduces caller control but unpinned upstream/cache config remains an input; token length does not bound config filename regex. Patch4.51.0; selected candidate5.10.0 needs actual loader/tokenizer/model compatibility and immutable artifact evidence. | Fix available but blocked by compatibility |
| [CVE-2025-5197](https://github.com/advisories/GHSA-9356-575x-2w9m)
GHSA-9356-575x-2w9m, PYSEC-2026-1983 | convert_tf_weight_name_to_pt_weight_name ReDoS
`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_tf_pytorch_utils.py` | < 4.53.0 → 4.53.0 | Installed55 TF→PyTorch converter consumes tensor weight names; app default PyTorch from_pretrained does not request from_tf or TensorFlow conversion. Checkpoint download route does not automatically imply this conversion. Different converter; no user weight-name input. Reassess if cross-framework checkpoint conversion added. | Mitigated with residual risk |
| [CVE-2026-1839](https://github.com/advisories/GHSA-69w3-r845-3855)
GHSA-69w3-r845-3855, PYSEC-2026-2288 | Trainer._load_rng_state unsafe torch.load
`tools/summarizer/.venv/Lib/site-packages/transformers/trainer.py` | < 5.0.0rc3 → 5.0.0rc3 | Installed3081 helper loads training rng_state checkpoint; app uses no Trainer, training resume or optimizer. GHSA text additionally limits exploit to torch below2.6; observed metadata2.6.0 does not satisfy that textual condition, although database Transformers range still matches. Both operation separation and vendor torch<2.6 precondition; this does not clear independent torch weights_only flaw24747. | Not affected with evidence |
| [CVE-2026-4372](https://github.com/advisories/GHSA-29pf-2h5f-8g72)
GHSA-29pf-2h5f-8g72, PYSEC-2026-2289 | model initialization config attention-kernel code loading
`tools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py` | < 5.3.0 → 5.3.0 | Shared config attention field exists in4.48.3, but _autoset_attn_implementation1486 rejects non-eager/non-known attention values with ValueError1498. No Hub kernel download dispatch in that method. Vendor describes later kernel-repository execution via serialized field; broad <5.3 range needs version-specific confirmation. Strong source evidence of older allowlist differs from broad range; need negative runtime config test/patch-introduction evidence before scoped Not affected. Upgrade candidate fixes broad range but no compatibility pass here. | Unresolved |
| [CVE-2026-5241](https://access.redhat.com/errata/RHSA-2026:34456)
GHSA-fgcw-684q-jj6r, PYSEC-2026-2290 | LightGlue nested AutoConfig remote-code override
`tools/summarizer/.venv/Lib/site-packages/transformers/models/lightglue` | < 5.5.0 → 5.5.0 | No LightGlue files/package in installed4.48.3; installed AutoModelForSeq2SeqLM maps BART and not LightGlue. Vendor report describes5.2.0 despite broad<5.5 range. Named vulnerable architecture absent from installed distribution; candidate5.10 >=5.5 patch. This does not clear shared model-load vulnerabilities. | Not affected with evidence |
| [CVE-2026-9856](https://github.com/advisories/GHSA-xrqw-3rrv-vx5w)
GHSA-xrqw-3rrv-vx5w, PYSEC-2026-3929 | tokenizer/Processor save_pretrained chat_template traversal
`tools/summarizer/.venv/Lib/site-packages/transformers/tokenization_utils_base.py` | < 5.10.0 → 5.10.0 | save_pretrained exists, but application only from_pretrained, tokenizer call/decode, model.generate; no tokenizer/processor export or user save path. Cache download writes are Hub file_download, not save_pretrained. No named save path in service; retain broad installed-package advisory and require5.10 patch if export introduced. | Not affected with evidence |
## Required qualification before a changed gate
For filelock, exercise native/fallback locks, two contenders, stale marker handling and timeout on each supported platform. For torch/Transformers, qualify candidate wheel imports and dependency checks, actual BART tokenizer IDs/decode and benign selected-checkpoint generation, text truncation, resource behavior and safe unavailable-model503 behavior. Record immutable snapshot revision, format and hashes. Safe negative config/remote-code tests can establish behavior without executing malicious serialized payloads. A synthetic tiny BART test only proves that synthetic fixture.
Refresh original aliases against the resolved lock, account for new advisories introduced by upgrades, preserve each no-fix/unresolved group and reconcile totals without adding duplicate aliases. A source-level scoped exemption needs reviewer acceptance; no package install, live provider call, production check or inference was performed in this research lane.