cesnimda
33 KiB
33 KiB
P9-SEC-02 advisory research
Read-only source assessment; no runtime compatibility or production acceptance claimed. All44 remaining groups are assessed individually in advisory-research.json. The JSON retains original alias IDs, affected ranges, fixed events, severity/vector, refreshed primary evidence, installed paths/hashes, input reachability, mitigation/residual, compatibility risks and required tests. Root qualification owns final dispositions.
Accounting
109 original alias groups =65 previously removed +44 researched here (filelock3, torch19, Transformers22). The earlier249→99 provider-record counts are retained and are not distinct vulnerability counts. This lane adds zero runtime/model qualification passes. No owner acceptance.
Minimal candidate graph and compatibility gates
- filelock4.2.1 addresses all three published filelock ranges. Qualify native and soft fallback lock ownership, contention/stale markers and finite timeouts on Windows and Linux; shared writable cache permissions are not established here.
- torch2.13.0+cpu is the smallest published all-fixable-record bound because JIT CVE-2025-3000 remains affected through2.12.1. The vendor CPU index advertises cp312 Windows amd64 and manylinux_2_28 x86_64 wheels. Use those CPU identities, not the PyPI generic Linux wheel that requires CUDA13. Actual wheel/import/inference qualification is pending.
- Transformers5.10.0 is the latest first-patched bound among these records (chat-template save traversal). Its base metadata requires huggingface-hub>=1.5,<2, tokenizers>=0.22,<=0.23, regex>=2025.10.22 and typer; current installed hub0.36.2/tokenizers0.21.4 cannot stay pinned. Resolve/hash the graph in isolation and preserve the65 prior remediations. Tagged5.10 source still has AutoModelForSeq2SeqLM and BART mapping; that is not import/inference proof.
- These versions do not establish closure of all44: eight ZDI conversion/deserialization groups and torch.pt2 have no verified release fix. CVE-2025-55554 has a still-open vendor issue despite a provider2.9 fix event. Never claim a fully safe graph from maximum version arithmetic alone.
Candidate metadata: filelock, torch, Transformers, vendor CPU index.98 distinct source responses retained: first54-request vendor/security batch succeeded, then all44 OSV refreshes succeeded.12 repeated GitHub API requests hit rate limits; initial successful raw bodies remain, with captured-file mtime explicitly distinguished from HTTP retrieval timestamps. Exact URLs, hashes and repeat errors are in .artifacts/p9-sec-02/advisory-research/refresh-index.json.
Actual service path and limits
app.py:161 loads fixed-name AutoTokenizer/AutoModelForSeq2SeqLM, calls eval, then tokenizer truncation1024 → no_grad → generate with3 beams → decode. Installed Auto mappings select BartTokenizer/Fast and BartForConditionalGeneration for a BART config. BART layers are attention/linear/norm; dropout exists but eval disables training dropout. This differs from LSTM, CTC, image pooling, sparse graphs, JIT/Inductor, TensorFlow optimizers and conversion CLIs. The parser child handles uploads via pypdf/Pillow/Tesseract, not Donut/Transformers video/CTC.
The actual serialized config/checkpoint remains a separate trust boundary: no immutable model revision or manifest is supplied by app.py; safetensors is not required. Installed Transformers load_state_dict493 reaches torch.load535 for non-safetensors files with weights_only=True. That flag does not protect torch2.6 from CVE-2026-24747. Do not dismiss loader risk just because app.py lacks a direct torch.load call. Fixed model name is not artifact integrity.
Installed source fingerprints are preserved in installed-source-matches.json; no Python model modules were imported. Windows METADATA reports torch2.6.0 rather than locked2.6.0+cpu. Installed model tree has no conversion scripts and no LightGlue implementation; these facts qualify specific paths and do not clear the entire package. Current4.48.3 attention selection rejects arbitrary repository strings; CVE-2026-4372 still needs an introduction/fix or safe negative regression before a definitive exemption.
Individual alias groups
Disposition is scoped to the current inspected service, and does not silently remove matching package records. “Fix available but blocked by compatibility” means qualification is pending, not that a failed compatibility test occurred. Published severities remain unchanged.
| Group / all aliases | Vulnerable function and installed locator | Range → patch | Service reachability and residual | Disposition |
|---|---|---|---|---|
| CVE-2026-112940 GHSA-v4x8-3wr5-3wq8 |
ReadWriteLock SQLite database reopen and POSIX symlink/side-file handlingtools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py |
>= 3.20.4, <= 4.2.0 → 4.2.1 | SQLite-backed ReadWriteLock is a different lock type from Hub WeakFileLock; installed Hub _fixes.py constructs FileLock then SoftFileLock. Remote document text cannot choose lock type or database filename. No ReadWriteLock application import/call. Scoped service lock selection excludes this SQLite API; package remains in affected range. Reassess if reader/writer locks are introduced. | Not affected with evidence |
| CVE-2026-112913 GHSA-9vhv-jxww-xfm5 |
ReadWriteLock Windows SQLite -wal/-journal/-shm handlingtools/summarizer/.venv/Lib/site-packages/filelock/_read_write.py |
>= 3.20.4, <= 4.2.0 → 4.2.1 | Requires local attacker-created SQLite side files in shared writable directory. Current cache helper uses native FileLock or SoftFileLock, not SQLite ReadWriteLock; parser has no filelock import. Service call graph excludes ReadWriteLock, not all uses of filelock. Cache directory permissions are not claimed verified. | Not affected with evidence |
| CVE-2026-112907 GHSA-567q-5qvw-pf92 |
SoftFileLock marker open/stale breaking on Windows oplocktools/summarizer/.venv/Lib/site-packages/filelock/_soft.py |
>= 3.22.0, <= 4.2.0 → 4.2.1 | Hub WeakFileLock fallback reaches SoftFileLock; filelock native lock can also fall back. Local user able to open cache marker can stall open beyond timeout. Cannot dismiss using HTTP request limits or parser child timeout. Upgrade filelock4.2.1; qualify native/fallback lock contention, stale marker and finite timeout on Windows and Linux. Existing source checks do not prove ACL isolation. | Fix available but blocked by compatibility |
| CVE-2025-3001 BIT-pytorch-2025-3001, GHSA-qfhq-4f3w-5fph, PYSEC-2025-195 |
torch.lstm_cell / native LSTM cell tensor validationtools/summarizer/.venv/Lib/site-packages/torch/nn/modules/rnn.py |
< 2.10.0 → 2.10.0 | Installed LSTMCell forwards to _VF.lstm_cell. BART decoder uses attention, linear and layer norms, not recurrent LSTMCell. Request text becomes bounded token IDs, not arbitrary tensor dimensions or Python graphs. BART architecture excludes LSTM operation; native wheel and future architectures remain vulnerable until patched. | Mitigated with residual risk |
| CVE-2025-3000 BIT-pytorch-2025-3000, GHSA-rrmf-rvhw-rf47, PYSEC-2025-194 |
torch.jit.script compilationtools/summarizer/.venv/Lib/site-packages/torch/jit/_script.py |
<= 2.12.1 → 2.13.0 | Application does not call script or torch.compile; model loader creates Python BART class and generate uses eager no_grad. Text cannot submit Python source or choose a compiled graph. Third-party optional branches/native internals are not runtime qualified. 2.13.0 is current published first patch; synthetic eager tests alone cannot prove selected checkpoint inference compatibility. | Fix available but blocked by compatibility |
| CVE-2025-2999 BIT-pytorch-2025-2999, GHSA-vgrw-7cvw-pwgx, PYSEC-2025-193 |
torch.nn.utils.rnn.unpack_sequencetools/summarizer/.venv/Lib/site-packages/torch/nn/utils/rnn.py |
< 2.9.1 → 2.9.1 | BART accepts padded input_ids plus attention_mask and does not construct PackedSequence or unpack_sequence; malicious tensor metadata is not an HTTP input. Different RNN API; retain affected-package finding until patched or scoped owner decision. | Mitigated with residual risk |
| CVE-2025-2953 BIT-pytorch-2025-2953, GHSA-3749-ghw9-m3mg, PYSEC-2025-191 |
torch.mkldnn_max_pool2dtools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py |
< 2.7.1-rc1 → 2.7.1-rc1 | Vendor names mkldnn_max_pool2d. BART attention/linear architecture contains no image/max-pooling layer. Raw image bytes go to separate OCR parser; they are not passed as model tensor graphs. No selected BART max-pooling path identified; local arbitrary Python remains outside HTTP boundary. | Mitigated with residual risk |
| CVE-2025-46148 BIT-pytorch-2025-46148, PYSEC-2025-198 |
nn.PairwiseDistance(p=2), eager/Inductor inconsistent resulttools/summarizer/.venv/Lib/site-packages/torch/nn/modules/distance.py |
Prior provider events → 2.7.0; exact ranges in JSON | Installed PairwiseDistance wrapper exists; BART/generate path does not compute pairwise distances. Vendor issue describes numeric correctness, not a demonstrated remotely supplied model graph. Architectural separation reduces service exposure; provider range and severity retained without claiming native safety. | Mitigated with residual risk |
| CVE-2025-46149 BIT-pytorch-2025-46149, PYSEC-2025-199 |
nn.Fold Inductor code generation assertiontools/summarizer/.venv/Lib/site-packages/torch/nn/modules/fold.py |
Prior provider events → 2.7.0; exact ranges in JSON | Fold constructs image blocks; BART text inference has no Fold and does not call torch.compile or Inductor. Requires a different operation and compiler route; preserve scanner finding until package patch. | Mitigated with residual risk |
| CVE-2025-46150 BIT-pytorch-2025-46150, PYSEC-2025-200 |
FractionalMaxPool2d torch.compile correctnesstools/summarizer/.venv/Lib/site-packages/torch/nn/modules/pooling.py |
Prior provider events → 2.7.0; exact ranges in JSON | No FractionalMaxPool2d in selected BART layers; application performs eager eval generation without compilation. Model graph cannot be supplied through text; unqualified optional/native branches remain residual. | Mitigated with residual risk |
| CVE-2025-46152 BIT-pytorch-2025-46152, PYSEC-2025-201 |
bitwise_right_shift boundary shift in Inductortools/summarizer/.venv/Lib/site-packages/torch/_inductor/codegen/cpp.py |
Prior provider events → 2.7.0; exact ranges in JSON | Vendor issue concerns compiled out-of-range shift count. Application accepts text, no arbitrary shift operand/compiler graph; selected BART layer source has no bitwise_right_shift. Eager BART separation; not a claim that every installed tensor operation is fixed. | Mitigated with residual risk |
| CVE-2025-46153 BIT-pytorch-2025-46153, PYSEC-2025-202 |
bernoulli_p decomposition, fallback_random, Dropout1d/2d/3dtools/summarizer/.venv/Lib/site-packages/torch/_decomp/decompositions.py |
Prior provider events → 2.7.0; exact ranges in JSON | BART contains functional.dropout, so merely saying no dropout would be false. model.eval() disables training dropout; app does not enable Inductor fallback_random nor spatial Dropout1d/2d/3d. Vendor source points to Inductor fallback; old summary says before3.7.0 while range fixes2.7.0. Preserve discrepancy and use exact provider events, not guessed3.7 pin. | Mitigated with residual risk |
| CVE-2025-55551 BIT-pytorch-2025-55551, PYSEC-2025-203 |
torch.linalg.lu with slicing in Inductor/AOTtools/summarizer/.venv/Lib/site-packages/torch/linalg/__init__.py |
Prior provider events → 2.9.0; exact ranges in JSON | Vendor issue contrasts compiled/AOT and eager LU slicing. BART attention does not perform LU decomposition and application has no compile/AOT route. Published range includes2.6 though issue title mentions2.8; no suppression solely from version in prose. | Mitigated with residual risk |
| CVE-2025-55552 BIT-pytorch-2025-55552, PYSEC-2025-204 |
torch.rot90 and randn_like compiled graphtools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py |
Prior provider events → 2.9.0; exact ranges in JSON | BART does not rotate image tensors or compile rot90/randn_like graphs. Text token IDs cannot select these APIs. Vendor issue is compiler/eager mismatch; package severity remains source-reported. | Mitigated with residual risk |
| CVE-2025-55553 BIT-pytorch-2025-55553, PYSEC-2025-205 |
proxy_tensor.py tracing .random_ syntax errortools/summarizer/.venv/Lib/site-packages/torch/fx/experimental/proxy_tensor.py |
Prior provider events → 2.7.1; exact ranges in JSON | Proxy tensor tracing/compiler route, not ordinary BART no_grad eager generation. Application exposes no graph tracing or caller-defined modules. No compiled tracing request boundary identified; changing execution mode needs new review. | Mitigated with residual risk |
| CVE-2025-55554 BIT-pytorch-2025-55554, PYSEC-2025-206 |
torch.nan_to_num then long edge-case numeric conversiontools/summarizer/.venv/Lib/site-packages/torch/_torch_docs.py |
Prior provider events → 2.9.0; exact ranges in JSON | Selected BART source has no nan_to_num().long() chain. Vendor issue remains open despite provider2.9.0 fix event; report does not infer closed/resolved from version metadata. Provider patch claim conflicts with still-open vendor issue. Need fix-commit/reproducer confirmation before Fixed verified. | Unresolved |
| CVE-2025-55557 BIT-pytorch-2025-55557, PYSEC-2025-207 |
Inductor compiled cummin Triton NameErrortools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py |
Prior provider events → 2.7.1; exact ranges in JSON | Selected BART attention and beam generation do not call compiled cummin; eager app supplies token text and uses CPU baseline rather than authored Triton kernels. Architectural reduction only; CPU and CUDA selection still require candidate qualification. | Mitigated with residual risk |
| CVE-2025-55558 BIT-pytorch-2025-55558, PYSEC-2025-208 |
Inductor Conv2d/hardshrink/view/mv compiler failuretools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py |
Prior provider events → 2.7.1; exact ranges in JSON | Vendor issue reports CppCompileError while scanner summary calls buffer overflow. BART is text attention/linear model, lacks this Conv2d/hardshrink chain, and app does not compile. Retain source disagreement; no security downgrade justified merely by compiler error title. | Mitigated with residual risk |
| CVE-2025-55560 BIT-pytorch-2025-55560, PYSEC-2025-209 |
Inductor to_sparse/to_dense loweringtools/summarizer/.venv/Lib/site-packages/torch/_inductor/lowering.py |
Prior provider events → 2.7.1; exact ranges in JSON | BART does not create sparse model inputs and app does not enable Inductor. Sparse tensor graph cannot be submitted through summarize text. Package remains affected according to provider; graph separation is a mitigation, not patch proof. | Mitigated with residual risk |
| CVE-2026-4538 BIT-pytorch-2026-4538, PYSEC-2026-139 |
torch.export.load .pt2 deserializationtools/summarizer/.venv/Lib/site-packages/torch/export/__init__.py |
Prior provider events → no published fix; exact ranges in JSON | Installed export.load API exists but Transformers load_state_dict uses safetensors or torch.load, not export.load. Neither app nor parser accepts .pt2 or model uploads. Fixed repository alone does not establish checkpoint integrity. No published fixed release in baseline ranges. Vendor PR176791 closed without merged_at; proposal requires explicit weights_only=True and cannot establish released patch. No export.load in service path. | No fix |
| CVE-2025-3730 BIT-pytorch-2025-3730, GHSA-887c-mr87-cxwp, PYSEC-2026-1970 |
torch.nn.functional.ctc_loss / native LossCTCtools/summarizer/.venv/Lib/site-packages/torch/nn/functional.py |
<= 2.7.1 → 2.8.0 | Vendor identifies CTC loss; service invokes BARTForConditionalGeneration.generate without labels, training or CTC. OCR uses Tesseract in parser child, not torch CTC. Specific alternate loss API, not generic model-resource bug. No inference/native compatibility PASS asserted. | Mitigated with residual risk |
| CVE-2026-24747 BIT-pytorch-2026-24747, GHSA-63cw-57p8-fm3p, PYSEC-2026-1856, PYSEC-2026-2286 |
torch.load(weights_only=True) unpickler memory corruptiontools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py |
< 2.10.0 → 2.10.0 | Actual installed load_state_dict493 forwards non-safetensors checkpoints to torch.load535 with weights_only=True. app.from_pretrained does not require safetensors or pin revision; therefore malicious or compromised model/cache checkpoint can reach vulnerable loader even though no direct app torch.load exists. Upgrade torch>=2.10 minimum for this issue; full published graph needs2.13.0. Require immutable revision, actual artifact format/hashes and benign inference. weights_only=True is not sufficient mitigation on2.6. | Fix available but blocked by compatibility |
| CVE-2025-14929 PYSEC-2025-217 |
X-CLIP checkpoint conversion unsafe deserializationtools/summarizer/.venv/Lib/site-packages/transformers/models/x_clip/convert_x_clip_original_pytorch_to_hf.py |
Prior provider events → no published fix; exact ranges in JSON | Installed wheel contains no convert files under transformers/models. BART auto model selection does not run X-CLIP conversion CLI; service accepts no checkpoint conversion arguments. Refreshed ZDI1144 still provides restriction mitigation, no patched version. Absent conversion script and fixed service route reduce exposure; no all-version package exemption. | No fix |
| CVE-2025-2099 GHSA-qq3j-4f4f-9583, PYSEC-2025-40 |
testing_utils.preprocess_string doctest ReDoStools/summarizer/.venv/Lib/site-packages/transformers/testing_utils.py |
< 4.50.0 → 4.50.0 | Installed2593 preprocess_string processes Python/Markdown doctest contents. App tokenizer does not use testing_utils; CV text/Markdown uploads go through parser normalization, not doctest preparation. Different function/input ownership; use4.50.0 current GHSA first patch rather than ambiguous prior4.49 event. | Not affected with evidence |
| CVE-2025-14926 PYSEC-2025-214 |
SEW conversion convert_config string evaltools/summarizer/.venv/Lib/site-packages/transformers/models/sew/convert_sew_original_pytorch_checkpoint_to_pytorch.py |
Prior provider events → no published fix; exact ranges in JSON | Conversion script is absent from installed models tree; BART inference has no SEW conversion or checkpoint argument input. ZDI1147 refreshed report remains0-day with no release patch. Do not add conversion capability; arbitrary model files remain untrusted. | No fix |
| CVE-2025-14930 PYSEC-2025-218 |
GLM4 weights parsing unsafe deserializationtools/summarizer/.venv/Lib/site-packages/transformers/models/glm4 |
Prior provider events → no published fix; exact ranges in JSON | No glm4 directory in installed4.48.3; selected mapping is BART, not GLM4. Advisory version range broader than named architecture availability; no assumption newest release fixes this. ZDI1145 still has no fixed version. Keep identity check for actual config; upgrading can introduce new architecture code. | No fix |
| CVE-2025-14920 PYSEC-2025-211 |
Perceiver model conversion/deserializationtools/summarizer/.venv/Lib/site-packages/transformers/models/perceiver |
Prior provider events → no published fix; exact ranges in JSON | Perceiver model package exists but no conversion scripts are installed. AutoModelForSeq2SeqLM maps bart to BartForConditionalGeneration; Perceiver has distinct model/configuration and tokenizer modules. No model upload endpoint. ZDI1150 no fix; actual Perceiver entry-point identity not published by ZDI beyond parsing. Treat family restriction as scoped mitigation rather than proven whole-package absence. | No fix |
| CVE-2025-14921 PYSEC-2025-212 |
Transformer-XL tokenizer/model pickle deserializationtools/summarizer/.venv/Lib/site-packages/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py |
Prior provider events → no published fix; exact ranges in JSON | Installed TransfoXL tokenizer explicitly contains pickle.load and warns/deprecates unsafe loading. BartTokenizer/BartTokenizerFast map uses JSON vocab/merges and byte BPE; no Transformer-XL vocab accepted by service. ZDI1149 no fixed release; dangerous API does exist. Architecture selection and no vocab upload reduce reachability; trust actual config identity before stronger verdict. | No fix |
| CVE-2025-14924 PYSEC-2025-213 |
megatron_gpt2 checkpoint conversion deserializationtools/summarizer/.venv/Lib/site-packages/transformers/models/megatron_gpt2/convert_megatron_gpt2_checkpoint.py |
Prior provider events → no published fix; exact ranges in JSON | Conversion scripts absent in installed models tree; selected BART loader uses standard load_state_dict, not Megatron conversion. General torch.load checkpoint risk tracked separately under24747. ZDI1141 says vendor declined changes; no patched version. Do not treat newer Transformers as closing this record without evidence. | No fix |
| CVE-2025-14927 PYSEC-2025-215 |
SEW-D convert_config evaltools/summarizer/.venv/Lib/site-packages/transformers/models/sew_d/convert_sew_d_original_pytorch_checkpoint_to_pytorch.py |
Prior provider events → no published fix; exact ranges in JSON | SEW-D conversion source absent from installed wheel. HTTP summarize does not expose conversion/config strings or select audio model families. ZDI1148 no fix; fixed model family is mitigation, not universal library safety. | No fix |
| CVE-2025-14928 PYSEC-2025-216 |
HuBERT convert_config evaltools/summarizer/.venv/Lib/site-packages/transformers/models/hubert/convert_hubert_original_pytorch_checkpoint_to_pytorch.py |
Prior provider events → no published fix; exact ranges in JSON | HuBERT conversion source absent from installed wheel; BART tokenizer/model path does not invoke audio conversion. ZDI1146 no release patch. Retain record rather than infer upgrade clears it. | No fix |
| CVE-2025-3933 GHSA-37mw-44qp-f5jm, PYSEC-2026-1977 |
DonutProcessor.token2json ReDoStools/summarizer/.venv/Lib/site-packages/transformers/models/donut/processing_donut.py |
<= 4.51.3 → 4.52.1 | Actual Donut token2json regex exists in separate processor. Service document OCR invokes Tesseract/Pillow, never DonutProcessor; BART decode returns text without token2json. Explicit different document-processing owner avoids confusing OCR with Donut; installed affected API remains. | Mitigated with residual risk |
| CVE-2025-6638 GHSA-59p9-h35m-wg4g, PYSEC-2026-1981 |
MarianTokenizer.remove_language_code ReDoStools/summarizer/.venv/Lib/site-packages/transformers/models/marian/tokenization_marian.py |
< 4.53.0 → 4.53.0 | Marian tokenizer removes language codes; BART maps to BartTokenizer/Fast with separate vocab/merges byte BPE. Request text cannot select Marian tokenizer. Architecture-specific tokenizer; validate actual model/tokenizer config before full Not affected claim. | Mitigated with residual risk |
| CVE-2025-3264 GHSA-jjph-296x-mrcr, PYSEC-2026-1985 |
dynamic_module_utils.get_imports Python-source regextools/summarizer/.venv/Lib/site-packages/transformers/dynamic_module_utils.py |
< 4.51.0 → 4.51.0 | Installed141 get_imports reads Python code. Auto factory540 executes dynamic module path only for has_remote_code and resolved trust_remote_code. Current app does not opt in, BART has local implementation; missing immutable artifact/config identity prevents universal dispatch proof. Fix4.51.0; upgrade candidate5.10.0. Explicitly deny remote code and qualify loader; do not conflate regex input with ordinary request text. | Fix available but blocked by compatibility |
| CVE-2025-1194 GHSA-fpwr-67px-3qhx, PYSEC-2026-1984 |
SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoStools/summarizer/.venv/Lib/site-packages/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py |
< 4.50.0 → 4.50.0 | Named GPT-NeoX-Japanese tokenizer exists as separate implementation; selected BART tokenizer uses byte BPE, not SubWordJapaneseTokenizer. Text cannot select tokenizer class directly. Do not label all tokenization ReDoS reachable merely because service tokenizes; actual family/config still needs identity. | Mitigated with residual risk |
| CVE-2025-3777 GHSA-phhr-52qp-3mj4, PYSEC-2026-1986 |
image_utils video URL username validationtools/summarizer/.venv/Lib/site-packages/transformers/image_utils.py |
< 4.52.1 → 4.52.1 | Installed4.48.3 image_utils has load_image (HTTP image URL) but no load_video/YouTube helper; video_utils.py is absent. BART receives text only; uploaded image bytes handled by PIL/Tesseract in parser, never a Transformers media URL helper. No Transformers video/YouTube URL input route. CV text containing a URL is text, not automatically dereferenced by this helper. | Not affected with evidence |
| CVE-2025-6051 GHSA-rcv9-qm8p-9p6j, PYSEC-2026-1988 |
CLVP EnglishNormalizer.normalize_numbers ReDoStools/summarizer/.venv/Lib/site-packages/transformers/models/clvp/number_normalizer.py |
< 4.53.0 → 4.53.0 | Actual normalize_numbers197 is CLVP text/audio normalizer; selected BART tokenizer has no EnglishNormalizer call. This is not generic normalize_text in parser_child.py. Keep distinct normalization owners and architecture scopes; model identity qualification remains needed. | Mitigated with residual risk |
| CVE-2025-6921 GHSA-4w7r-h757-3r74, PYSEC-2026-1980 |
AdamWeightDecay._do_use_weight_decay user regextools/summarizer/.venv/Lib/site-packages/transformers/optimization_tf.py |
< 4.53.0 → 4.53.0 | TensorFlow training optimizer branch. Service performs torch.no_grad model.eval generation; no optimizer, training patterns or TensorFlow model conversion requested. No optimizer input boundary or training invocation; tensor generation length controls do not constitute the mitigation. | Not affected with evidence |
| CVE-2025-3263 GHSA-q2wp-rjmx-x6x9, PYSEC-2026-1987 |
configuration_utils.get_configuration_file ReDoStools/summarizer/.venv/Lib/site-packages/transformers/configuration_utils.py |
< 4.51.0 → 4.51.0 | Installed1134 function consumes configuration_files list from model config in shared from_pretrained path. Fixed repository name reduces caller control but unpinned upstream/cache config remains an input; token length does not bound config filename regex. Patch4.51.0; selected candidate5.10.0 needs actual loader/tokenizer/model compatibility and immutable artifact evidence. | Fix available but blocked by compatibility |
| CVE-2025-5197 GHSA-9356-575x-2w9m, PYSEC-2026-1983 |
convert_tf_weight_name_to_pt_weight_name ReDoStools/summarizer/.venv/Lib/site-packages/transformers/modeling_tf_pytorch_utils.py |
< 4.53.0 → 4.53.0 | Installed55 TF→PyTorch converter consumes tensor weight names; app default PyTorch from_pretrained does not request from_tf or TensorFlow conversion. Checkpoint download route does not automatically imply this conversion. Different converter; no user weight-name input. Reassess if cross-framework checkpoint conversion added. | Mitigated with residual risk |
| CVE-2026-1839 GHSA-69w3-r845-3855, PYSEC-2026-2288 |
Trainer._load_rng_state unsafe torch.loadtools/summarizer/.venv/Lib/site-packages/transformers/trainer.py |
< 5.0.0rc3 → 5.0.0rc3 | Installed3081 helper loads training rng_state checkpoint; app uses no Trainer, training resume or optimizer. GHSA text additionally limits exploit to torch below2.6; observed metadata2.6.0 does not satisfy that textual condition, although database Transformers range still matches. Both operation separation and vendor torch<2.6 precondition; this does not clear independent torch weights_only flaw24747. | Not affected with evidence |
| CVE-2026-4372 GHSA-29pf-2h5f-8g72, PYSEC-2026-2289 |
model initialization config attention-kernel code loadingtools/summarizer/.venv/Lib/site-packages/transformers/modeling_utils.py |
< 5.3.0 → 5.3.0 | Shared config attention field exists in4.48.3, but _autoset_attn_implementation1486 rejects non-eager/non-known attention values with ValueError1498. No Hub kernel download dispatch in that method. Vendor describes later kernel-repository execution via serialized field; broad <5.3 range needs version-specific confirmation. Strong source evidence of older allowlist differs from broad range; need negative runtime config test/patch-introduction evidence before scoped Not affected. Upgrade candidate fixes broad range but no compatibility pass here. | Unresolved |
| CVE-2026-5241 GHSA-fgcw-684q-jj6r, PYSEC-2026-2290 |
LightGlue nested AutoConfig remote-code overridetools/summarizer/.venv/Lib/site-packages/transformers/models/lightglue |
< 5.5.0 → 5.5.0 | No LightGlue files/package in installed4.48.3; installed AutoModelForSeq2SeqLM maps BART and not LightGlue. Vendor report describes5.2.0 despite broad<5.5 range. Named vulnerable architecture absent from installed distribution; candidate5.10 >=5.5 patch. This does not clear shared model-load vulnerabilities. | Not affected with evidence |
| CVE-2026-9856 GHSA-xrqw-3rrv-vx5w, PYSEC-2026-3929 |
tokenizer/Processor save_pretrained chat_template traversaltools/summarizer/.venv/Lib/site-packages/transformers/tokenization_utils_base.py |
< 5.10.0 → 5.10.0 | save_pretrained exists, but application only from_pretrained, tokenizer call/decode, model.generate; no tokenizer/processor export or user save path. Cache download writes are Hub file_download, not save_pretrained. No named save path in service; retain broad installed-package advisory and require5.10 patch if export introduced. | Not affected with evidence |
Required qualification before a changed gate
For filelock, exercise native/fallback locks, two contenders, stale marker handling and timeout on each supported platform. For torch/Transformers, qualify candidate wheel imports and dependency checks, actual BART tokenizer IDs/decode and benign selected-checkpoint generation, text truncation, resource behavior and safe unavailable-model503 behavior. Record immutable snapshot revision, format and hashes. Safe negative config/remote-code tests can establish behavior without executing malicious serialized payloads. A synthetic tiny BART test only proves that synthetic fixture.
Refresh original aliases against the resolved lock, account for new advisories introduced by upgrades, preserve each no-fix/unresolved group and reconcile totals without adding duplicate aliases. A source-level scoped exemption needs reviewer acceptance; no package install, live provider call, production check or inference was performed in this research lane.