cesnimda
1239 lines
58 KiB
JSON
1239 lines
58 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"generatedUtc": "2026-10-25T07:11:14.466543+00:00",
|
|
"scope": "Focused reassessment of9 NoFix groups plus numeric issue55554 against final locally built Linux CPU runtime image. Original44-row research remains historical and unchanged.",
|
|
"gate": "SCOPED_SOURCE_ASSESSMENT_ONLY_NOT_GLOBAL_PATCH_OR_PRODUCTION_ACCEPTANCE",
|
|
"sourceImage": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331",
|
|
"qualificationImage": "sha256:15a8364ba158a8042d6183bdc58f8167e39a227b7addce3ccb7d35675fc6761f",
|
|
"runtimeVersions": {
|
|
"torch": "2.13.0+cpu",
|
|
"transformers": "5.10.0",
|
|
"filelock": "4.2.1",
|
|
"huggingface-hub": "1.33.0",
|
|
"tokenizers": "0.22.2"
|
|
},
|
|
"appSha256": "aab24c7f64868fcb93a6133aa7b2087b23f98469e89e4c84fa040a022b0a8dfc",
|
|
"lockSha256": "3a3afc529f0076a1b5d67082c9269c22c12f52c47ecf95ce0c76c37b39d8297a",
|
|
"captureProcess": {
|
|
"startedUtc": "2026-10-25T07:05:16.437530+00:00",
|
|
"finishedUtc": "2026-10-25T07:05:17.336071+00:00",
|
|
"command": [
|
|
"docker",
|
|
"run",
|
|
"--rm",
|
|
"--entrypoint",
|
|
"python",
|
|
"--network",
|
|
"none",
|
|
"--read-only",
|
|
"--user",
|
|
"65534:65534",
|
|
"--cap-drop",
|
|
"ALL",
|
|
"--security-opt",
|
|
"no-new-privileges",
|
|
"--pids-limit",
|
|
"32",
|
|
"--cpus",
|
|
"1",
|
|
"--memory",
|
|
"512m",
|
|
"-e",
|
|
"PYTHONDONTWRITEBYTECODE=1",
|
|
"--mount",
|
|
"type=bind,src=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-sec-02\\current-source,dst=/capture,readonly",
|
|
"sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331",
|
|
"/capture/capture.py"
|
|
],
|
|
"image": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331",
|
|
"exitCode": 0,
|
|
"sourceSha256": "0bd220f790c2623f0b0f48f1f604e54d65d765b8a6bedc11ec9a2d9471be0bf7",
|
|
"timeoutSeconds": 60,
|
|
"scope": "One network-none read-only static source capture. No model/module imports, inference or tests."
|
|
},
|
|
"captureFileSha256": "0bd220f790c2623f0b0f48f1f604e54d65d765b8a6bedc11ec9a2d9471be0bf7",
|
|
"generationCaptureProcess": {
|
|
"startedUtc": "2026-10-25T07:09:31.000739+00:00",
|
|
"finishedUtc": "2026-10-25T07:09:31.773443+00:00",
|
|
"command": [
|
|
"docker",
|
|
"run",
|
|
"--rm",
|
|
"--entrypoint",
|
|
"python",
|
|
"--network",
|
|
"none",
|
|
"--read-only",
|
|
"--user",
|
|
"65534:65534",
|
|
"--cap-drop",
|
|
"ALL",
|
|
"--security-opt",
|
|
"no-new-privileges",
|
|
"--pids-limit",
|
|
"32",
|
|
"--cpus",
|
|
"1",
|
|
"--memory",
|
|
"512m",
|
|
"-e",
|
|
"PYTHONDONTWRITEBYTECODE=1",
|
|
"--mount",
|
|
"type=bind,src=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-sec-02\\current-source,dst=/capture,readonly",
|
|
"sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331",
|
|
"/capture/capture_generation.py"
|
|
],
|
|
"image": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331",
|
|
"exitCode": 0,
|
|
"sourceSha256": "9a4e7cca10572fcc2763c4b43016aee857ca3d5bb57f77ff7343f4bc0ca5b763",
|
|
"timeoutSeconds": 60,
|
|
"scope": "Second explicitly authorized read-only network-none static capture: generation implementation, no imports/inference/tests.",
|
|
"priorAttempts": [
|
|
{
|
|
"startedUtc": "2026-10-25T07:08:56.511369+00:00",
|
|
"finishedUtc": "2026-10-25T07:08:57.293617+00:00",
|
|
"command": [
|
|
"docker",
|
|
"run",
|
|
"--rm",
|
|
"--entrypoint",
|
|
"python",
|
|
"--network",
|
|
"none",
|
|
"--read-only",
|
|
"--user",
|
|
"65534:65534",
|
|
"--cap-drop",
|
|
"ALL",
|
|
"--security-opt",
|
|
"no-new-privileges",
|
|
"--pids-limit",
|
|
"32",
|
|
"--cpus",
|
|
"1",
|
|
"--memory",
|
|
"512m",
|
|
"-e",
|
|
"PYTHONDONTWRITEBYTECODE=1",
|
|
"--mount",
|
|
"type=bind,src=E:\\Storage\\Projects\\Active\\Job tracker\\.artifacts\\p9-sec-02\\current-source,dst=/capture,readonly",
|
|
"sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331",
|
|
"/capture/capture_generation.py"
|
|
],
|
|
"image": "sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331",
|
|
"exitCode": 1,
|
|
"sourceSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
|
"timeoutSeconds": 60,
|
|
"scope": "Second explicitly authorized read-only network-none static capture: generation implementation, no imports/inference/tests."
|
|
}
|
|
]
|
|
},
|
|
"generationSourceEvidence": [
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/generation/utils.py",
|
|
"exists": true,
|
|
"sha256": "ed15c08cee3c93f177da242308ad3151e2d95829a017e60c77c444f02984b603",
|
|
"nanToNumCallTextOccurrences": 0,
|
|
"matches": [
|
|
{
|
|
"line": 82,
|
|
"text": " InfNanRemoveLogitsProcessor,"
|
|
},
|
|
{
|
|
"line": 721,
|
|
"text": " position_ids = attention_mask.long().cumsum(-1) - 1"
|
|
},
|
|
{
|
|
"line": 760,
|
|
"text": " attention_mask_from_padding = inputs_tensor.ne(pad_token_id).long()"
|
|
},
|
|
{
|
|
"line": 1198,
|
|
"text": " if generation_config.remove_invalid_values is True:"
|
|
},
|
|
{
|
|
"line": 1199,
|
|
"text": " processors.append(InfNanRemoveLogitsProcessor())"
|
|
},
|
|
{
|
|
"line": 1468,
|
|
"text": " stacked_scores = torch.nn.functional.log_softmax(stacked_scores, dim=1)"
|
|
},
|
|
{
|
|
"line": 1473,
|
|
"text": " max_beam_length = (1 - beam_indices_mask.long()).sum(-1).max()"
|
|
},
|
|
{
|
|
"line": 2039,
|
|
"text": " def _valid_auto_compile_criteria("
|
|
},
|
|
{
|
|
"line": 2052,
|
|
"text": " valid_hardware = self.device.type in [\"cuda\", \"xpu\", \"neuron\", \"tpu\"] or bool("
|
|
},
|
|
{
|
|
"line": 2053,
|
|
"text": " generation_config.compile_config is not None and generation_config.compile_config._compile_all_devices"
|
|
},
|
|
{
|
|
"line": 2058,
|
|
"text": " can_compile = valid_hardware and using_compilable_cache"
|
|
},
|
|
{
|
|
"line": 2643,
|
|
"text": " input_ids = torch.where(input_ids == bos_token_id, pad_token_id, input_ids)"
|
|
},
|
|
{
|
|
"line": 2956,
|
|
"text": " worst_finished_score = torch.where(is_sent_finished, torch.min(beam_scores, dim=1, keepdim=True)[0], -1.0e9)"
|
|
},
|
|
{
|
|
"line": 2962,
|
|
"text": " def _beam_search_has_unfinished_sequences("
|
|
},
|
|
{
|
|
"line": 3020,
|
|
"text": " topk_log_probs, topk_indices = torch.topk(accumulated_log_probs, k=beams_to_keep)"
|
|
},
|
|
{
|
|
"line": 3023,
|
|
"text": " topk_current_beam_indices = topk_indices // vocab_size"
|
|
},
|
|
{
|
|
"line": 3026,
|
|
"text": " topk_ids = topk_indices % vocab_size"
|
|
},
|
|
{
|
|
"line": 3054,
|
|
"text": " next_topk_indices = torch.topk(topk_running_log_probs, k=num_beams)[1]"
|
|
},
|
|
{
|
|
"line": 3106,
|
|
"text": " topk_merged_indices = torch.topk(merged_scores, k=num_beams)[1]"
|
|
},
|
|
{
|
|
"line": 3115,
|
|
"text": " def _beam_search("
|
|
},
|
|
{
|
|
"line": 3278,
|
|
"text": " model_outputs = self(**model_inputs, return_dict=True)"
|
|
},
|
|
{
|
|
"line": 3295,
|
|
"text": " log_probs = nn.functional.log_softmax(logits, dim=-1)"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/generation/logits_process.py",
|
|
"exists": true,
|
|
"sha256": "e0b62e949a3510cac6d762ce7ac1968f2622ae01edb7a2ef7d555bff9da310cf",
|
|
"nanToNumCallTextOccurrences": 0,
|
|
"matches": [
|
|
{
|
|
"line": 160,
|
|
"text": " scores_processed = torch.where(eos_token_mask, -math.inf, scores)"
|
|
},
|
|
{
|
|
"line": 233,
|
|
"text": " scores_processed = torch.where(eos_token_mask, -math.inf, scores)"
|
|
},
|
|
{
|
|
"line": 390,
|
|
"text": " penalty_scores = torch.where(last_scores < 0, last_scores * self.penalty, last_scores / self.penalty)"
|
|
},
|
|
{
|
|
"line": 391,
|
|
"text": " scores[0, last_positions, :] = torch.where(token_mask, penalty_scores, last_scores)"
|
|
},
|
|
{
|
|
"line": 402,
|
|
"text": " penalty_scores = torch.where(last_scores < 0, last_scores * self.penalty, last_scores / self.penalty)"
|
|
},
|
|
{
|
|
"line": 403,
|
|
"text": " scores[:, -1, :] = torch.where(token_mask, penalty_scores, last_scores)"
|
|
},
|
|
{
|
|
"line": 411,
|
|
"text": " score = torch.where(score < 0, score * self.penalty, score / self.penalty)"
|
|
},
|
|
{
|
|
"line": 467,
|
|
"text": " score = torch.where(score < 0, score * self.penalty, score / self.penalty)"
|
|
},
|
|
{
|
|
"line": 593,
|
|
"text": " indices_to_remove = scores < torch.topk(scores, top_k)[0][..., -1, None]"
|
|
},
|
|
{
|
|
"line": 669,
|
|
"text": " top_logits, top_idx = torch.topk(scores, top_n, dim=-1, largest=True, sorted=True)"
|
|
},
|
|
{
|
|
"line": 773,
|
|
"text": " sorted_indices = torch.topk(probs, k, dim=-1).indices"
|
|
},
|
|
{
|
|
"line": 847,
|
|
"text": " normalized = torch.nn.functional.log_softmax(scores, dim=-1)"
|
|
},
|
|
{
|
|
"line": 931,
|
|
"text": " indices_to_remove = indices_to_remove & (scores < torch.topk(scores, top_k)[0][..., -1, None])"
|
|
},
|
|
{
|
|
"line": 1015,
|
|
"text": " indices_to_remove = indices_to_remove & (scores < torch.topk(scores, top_k)[0][..., -1, None])"
|
|
},
|
|
{
|
|
"line": 1316,
|
|
"text": " bias[:, last_token] += torch.where("
|
|
},
|
|
{
|
|
"line": 1662,
|
|
"text": "class InfNanRemoveLogitsProcessor(LogitsProcessor):"
|
|
},
|
|
{
|
|
"line": 1674,
|
|
"text": " scores_processed = torch.where(scores != scores, 0.0, scores)"
|
|
},
|
|
{
|
|
"line": 1677,
|
|
"text": " scores_processed = torch.where(scores == float(\"inf\"), torch.finfo(scores.dtype).max, scores_processed)"
|
|
},
|
|
{
|
|
"line": 1678,
|
|
"text": " scores_processed = torch.where(scores == -float(\"inf\"), torch.finfo(scores.dtype).min, scores_processed)"
|
|
},
|
|
{
|
|
"line": 1817,
|
|
"text": " scores_processed = scores.log_softmax(dim=-1)"
|
|
},
|
|
{
|
|
"line": 1869,
|
|
"text": " scores_processed = torch.where(suppress_token_mask, -float(\"inf\"), scores)"
|
|
},
|
|
{
|
|
"line": 1910,
|
|
"text": " scores = torch.where(suppress_token_mask, -float(\"inf\"), scores)"
|
|
},
|
|
{
|
|
"line": 2045,
|
|
"text": " logprobs = torch.nn.functional.log_softmax(scores_processed.float(), dim=-1)"
|
|
},
|
|
{
|
|
"line": 2336,
|
|
"text": " scores = torch.nn.functional.log_softmax(scores, dim=-1)"
|
|
},
|
|
{
|
|
"line": 2342,
|
|
"text": " unconditional_logits = torch.nn.functional.log_softmax(logits[:, -1], dim=-1)"
|
|
},
|
|
{
|
|
"line": 2389,
|
|
"text": " scores_processed = torch.where(do_early_stop, early_stop_scores, scores)"
|
|
},
|
|
{
|
|
"line": 2702,
|
|
"text": " log_probs = torch.where(torch.isfinite(log_probs), log_probs, torch.finfo(log_probs.dtype).min)"
|
|
},
|
|
{
|
|
"line": 2761,
|
|
"text": " updated_watermarked_scores = torch.where("
|
|
},
|
|
{
|
|
"line": 3066,
|
|
"text": " _, top_k_indices = torch.topk(scores_processed, k=self.guidance_top_k, dim=-1)"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/generation/configuration_utils.py",
|
|
"exists": true,
|
|
"sha256": "fa9997a5334fa132f2911f7518163d963a706a82ade7ebca78afce69bfdc3c39",
|
|
"nanToNumCallTextOccurrences": 0,
|
|
"matches": [
|
|
{
|
|
"line": 242,
|
|
"text": " remove_invalid_values (`bool`):"
|
|
},
|
|
{
|
|
"line": 244,
|
|
"text": " Note that using `remove_invalid_values` can slow down generation."
|
|
},
|
|
{
|
|
"line": 410,
|
|
"text": " self.remove_invalid_values = kwargs.pop(\"remove_invalid_values\", None)"
|
|
},
|
|
{
|
|
"line": 595,
|
|
"text": " \"remove_invalid_values\": False,"
|
|
},
|
|
{
|
|
"line": 1598,
|
|
"text": " _compile_all_devices = None"
|
|
},
|
|
{
|
|
"line": 1602,
|
|
"text": " return copy.deepcopy({key: value for key, value in self.__dict__.items() if key != \"_compile_all_devices\"})"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/generation/beam_search.py",
|
|
"exists": false,
|
|
"sha256": null,
|
|
"nanToNumCallTextOccurrences": 0,
|
|
"matches": []
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/models/bart/modeling_bart.py",
|
|
"exists": true,
|
|
"sha256": "8b2d998585a095967a72d27fc3f6ebe96c0e8b19256e7f22bb2577d98bc5885a",
|
|
"nanToNumCallTextOccurrences": 0,
|
|
"matches": []
|
|
},
|
|
{
|
|
"path": "/app/app.py",
|
|
"exists": true,
|
|
"sha256": "aab24c7f64868fcb93a6133aa7b2087b23f98469e89e4c84fa040a022b0a8dfc",
|
|
"nanToNumCallTextOccurrences": 0,
|
|
"matches": []
|
|
}
|
|
],
|
|
"numericScopeFalsifiers": [
|
|
"Any nan_to_num result cast to int64/long introduced into BART forward, generation/logits helpers or caller/custom processor.",
|
|
"CPU graph compilation explicitly enabled, different native kernel path/quantization/backend/device used, or user tensor/model/processor graph input added.",
|
|
"Evidence that the named upstream issue is reached by the exact preserved BART/logits/token-ID operations despite the absent chain."
|
|
],
|
|
"qualificationCheckpoint": {
|
|
"path": ".artifacts/p9-sec-02/qualification-checkpoint/result.json",
|
|
"sha256": "7261a039c8acca3ccfd13b90a298640695f67d0d384184248463e691f725248a",
|
|
"status": "PASS",
|
|
"interpretation": "Existing bounded local compatibility evidence:59 sidecar tests, two synthetic-weight BART serialization paths using real pinned tokenizer,9 cache/negative/lock cases,5 parser/OCR cases and HTTP startup. These are not59+additional overlapping unit tests nor production/full-model qualification."
|
|
},
|
|
"pinnedModelIdentity": {
|
|
"repository": "sshleifer/distilbart-cnn-12-6",
|
|
"revision": "a4f8f3ea906ed274767e9906dbaede7531d660ff",
|
|
"referenceConfigSha256": "028d72a28b90a369eff3f99ceb585fbd2ababf070e8577d72c315757a49b8917",
|
|
"modelType": "bart",
|
|
"architecture": [
|
|
"BartForConditionalGeneration"
|
|
],
|
|
"expectedFullCheckpointSha256": "3bac65d18c99463302d12ca75c2220ea714f9c81ce235f205fa818efe71df6ea",
|
|
"fullCheckpointPresent": false,
|
|
"fullCheckpointExpectedBytes": 1222317369,
|
|
"identityGap": "Pinned reference config/tokenizer verified; full checkpoint bytes are absent and actual hash/load/resources/semantic output remain unverified."
|
|
},
|
|
"scopedNotAffectedCriteria": [
|
|
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
|
|
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
|
|
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
|
|
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
|
|
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
|
|
],
|
|
"scopedNotAffectedIsLegitimateWithoutFullWeights": "Yes for named absent conversion scripts, removed Transformer-XL, excluded GLM4/Perceiver families and unused export.load API: full BART numeric weights cannot turn the fixed BART loader into those separate entry points under these scope conditions. Also justified for the precise55554 nan_to_num-to-long chain after capturing actual generation/logits/config source and excluding the chain; finite synthetic logits alone would not justify it.",
|
|
"currentSourceEvidence": [
|
|
{
|
|
"path": "/app/app.py",
|
|
"exists": true,
|
|
"sha256": "aab24c7f64868fcb93a6133aa7b2087b23f98469e89e4c84fa040a022b0a8dfc",
|
|
"matches": [
|
|
{
|
|
"line": 96,
|
|
"text": "MODEL_NAME = \"sshleifer/distilbart-cnn-12-6\""
|
|
},
|
|
{
|
|
"line": 98,
|
|
"text": "MODEL_REVISION = \"a4f8f3ea906ed274767e9906dbaede7531d660ff\""
|
|
},
|
|
{
|
|
"line": 164,
|
|
"text": " tokenizer = AutoTokenizer.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False)"
|
|
},
|
|
{
|
|
"line": 165,
|
|
"text": " model = AutoModelForSeq2SeqLM.from_pretrained(MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False, weights_only=True)"
|
|
},
|
|
{
|
|
"line": 166,
|
|
"text": " model.eval()"
|
|
},
|
|
{
|
|
"line": 295,
|
|
"text": " \"model\": MODEL_NAME,"
|
|
},
|
|
{
|
|
"line": 519,
|
|
"text": " with torch.no_grad():"
|
|
},
|
|
{
|
|
"line": 520,
|
|
"text": " outputs = model.generate("
|
|
},
|
|
{
|
|
"line": 1320,
|
|
"text": "async def extract_text(file: UploadFile = File(...)):"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/models/auto/modeling_auto.py",
|
|
"exists": true,
|
|
"sha256": "0183af680a0922b24683fe63ecf3d120357247d473645f4834df6e22e2ff2f04",
|
|
"matches": [
|
|
{
|
|
"line": 535,
|
|
"text": " (\"bart\", \"BartForConditionalGeneration\"),"
|
|
},
|
|
{
|
|
"line": 1100,
|
|
"text": " (\"bart\", \"BartForConditionalGeneration\"),"
|
|
},
|
|
{
|
|
"line": 1219,
|
|
"text": " (\"bart\", \"BartForConditionalGeneration\"),"
|
|
},
|
|
{
|
|
"line": 2076,
|
|
"text": "class AutoModelForSeq2SeqLM(_BaseAutoModelClass):"
|
|
},
|
|
{
|
|
"line": 2077,
|
|
"text": " _model_mapping = MODEL_FOR_SEQ_TO_SEQ_CAUSAL_LM_MAPPING"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/models/auto/auto_factory.py",
|
|
"exists": true,
|
|
"sha256": "3e3b2bbb4c5219283d2df5e1686062496023d5d3ec09cd63aac808e675e0338c",
|
|
"matches": [
|
|
{
|
|
"line": 27,
|
|
"text": "from ...dynamic_module_utils import get_class_from_dynamic_module, resolve_trust_remote_code"
|
|
},
|
|
{
|
|
"line": 140,
|
|
"text": " trust_remote_code (`bool`, *optional*, defaults to `False`):"
|
|
},
|
|
{
|
|
"line": 208,
|
|
"text": " trust_remote_code = kwargs.pop(\"trust_remote_code\", None)"
|
|
},
|
|
{
|
|
"line": 209,
|
|
"text": " has_remote_code = hasattr(config, \"auto_map\") and cls.__name__ in config.auto_map"
|
|
},
|
|
{
|
|
"line": 214,
|
|
"text": " if has_remote_code:"
|
|
},
|
|
{
|
|
"line": 220,
|
|
"text": " trust_remote_code = resolve_trust_remote_code("
|
|
},
|
|
{
|
|
"line": 221,
|
|
"text": " trust_remote_code, config._name_or_path, has_local_code, has_remote_code, upstream_repo=upstream_repo"
|
|
},
|
|
{
|
|
"line": 224,
|
|
"text": " if has_remote_code and trust_remote_code and not explicit_local_code:"
|
|
},
|
|
{
|
|
"line": 230,
|
|
"text": " # This block handles the case where the user is loading a model with `trust_remote_code=True`"
|
|
},
|
|
{
|
|
"line": 240,
|
|
"text": " model_class = _get_model_class(config, cls._model_mapping)"
|
|
},
|
|
{
|
|
"line": 266,
|
|
"text": " trust_remote_code = kwargs.get(\"trust_remote_code\")"
|
|
},
|
|
{
|
|
"line": 356,
|
|
"text": " has_remote_code = hasattr(config, \"auto_map\") and cls.__name__ in config.auto_map"
|
|
},
|
|
{
|
|
"line": 362,
|
|
"text": " if has_remote_code:"
|
|
},
|
|
{
|
|
"line": 366,
|
|
"text": " trust_remote_code = resolve_trust_remote_code("
|
|
},
|
|
{
|
|
"line": 367,
|
|
"text": " trust_remote_code,"
|
|
},
|
|
{
|
|
"line": 370,
|
|
"text": " has_remote_code,"
|
|
},
|
|
{
|
|
"line": 373,
|
|
"text": " kwargs[\"trust_remote_code\"] = trust_remote_code"
|
|
},
|
|
{
|
|
"line": 378,
|
|
"text": " if has_remote_code and trust_remote_code and not explicit_local_code:"
|
|
},
|
|
{
|
|
"line": 383,
|
|
"text": " # This block handles the case where the user is loading a model with `trust_remote_code=True`"
|
|
},
|
|
{
|
|
"line": 394,
|
|
"text": " model_class = _get_model_class(config, cls._model_mapping)"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/models/bart/tokenization_bart.py",
|
|
"exists": true,
|
|
"sha256": "0e73c1fb692c6aad57297fb8202ea243e0797cf52c12b415ac33e7ff847b5fc0",
|
|
"matches": [
|
|
{
|
|
"line": 11,
|
|
"text": "tokenizer as RoBERTa, so we expose `BartTokenizer` and `BartTokenizerFast`"
|
|
},
|
|
{
|
|
"line": 16,
|
|
"text": "from ..roberta.tokenization_roberta import RobertaTokenizer as _RobertaTokenizer"
|
|
},
|
|
{
|
|
"line": 20,
|
|
"text": "BartTokenizer = _RobertaTokenizer"
|
|
},
|
|
{
|
|
"line": 21,
|
|
"text": "BartTokenizerFast = _RobertaTokenizer"
|
|
},
|
|
{
|
|
"line": 23,
|
|
"text": "__all__ = [\"BartTokenizer\", \"BartTokenizerFast\"]"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/models/bart/modeling_bart.py",
|
|
"exists": true,
|
|
"sha256": "8b2d998585a095967a72d27fc3f6ebe96c0e8b19256e7f22bb2577d98bc5885a",
|
|
"matches": [
|
|
{
|
|
"line": 306,
|
|
"text": " hidden_states = torch.clamp(hidden_states, min=-clamp_value, max=clamp_value)"
|
|
},
|
|
{
|
|
"line": 801,
|
|
"text": "class BartForConditionalGeneration(BartPreTrainedModel, GenerationMixin):"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/transformers/modeling_utils.py",
|
|
"exists": true,
|
|
"sha256": "d6336507caf5fa4ea441934009d88c644a15640c6130084a72a20b64235f3ef8",
|
|
"matches": [
|
|
{
|
|
"line": 189,
|
|
"text": " weights_only: bool = True"
|
|
},
|
|
{
|
|
"line": 337,
|
|
"text": "def load_state_dict("
|
|
},
|
|
{
|
|
"line": 340,
|
|
"text": " weights_only: bool = True,"
|
|
},
|
|
{
|
|
"line": 376,
|
|
"text": " # Fallback to torch.load (if weights_only was explicitly False, do not check safety as this is known to be unsafe)"
|
|
},
|
|
{
|
|
"line": 377,
|
|
"text": " if weights_only:"
|
|
},
|
|
{
|
|
"line": 384,
|
|
"text": " return torch.load(checkpoint_path, map_location=map_location, weights_only=weights_only, **extra_args)"
|
|
},
|
|
{
|
|
"line": 827,
|
|
"text": " weights_only: bool,"
|
|
},
|
|
{
|
|
"line": 853,
|
|
"text": " checkpoint_files[0], map_location=\"meta\", weights_only=weights_only"
|
|
},
|
|
{
|
|
"line": 3879,
|
|
"text": " weights_only: bool = True,"
|
|
},
|
|
{
|
|
"line": 4065,
|
|
"text": " weights_only (`bool`, *optional*, defaults to `True`):"
|
|
},
|
|
{
|
|
"line": 4260,
|
|
"text": " config, quantization_config, device_map, weights_only, user_agent"
|
|
},
|
|
{
|
|
"line": 4298,
|
|
"text": " dtype, checkpoint_files, config, sharded_metadata, state_dict, weights_only, hf_quantizer"
|
|
},
|
|
{
|
|
"line": 4376,
|
|
"text": " weights_only=weights_only,"
|
|
},
|
|
{
|
|
"line": 4475,
|
|
"text": " weights_only=load_config.weights_only,"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/torch/export/__init__.py",
|
|
"exists": true,
|
|
"sha256": "5a6382799fe55ec3a865c73a706348dccf6ebb81e11bc03a485420fed657c6aa",
|
|
"matches": [
|
|
{
|
|
"line": 283,
|
|
"text": "def load("
|
|
},
|
|
{
|
|
"line": 296,
|
|
"text": " :func:`torch.export.load()` uses pickle under the hood to load models. **Never load data from an untrusted source.**"
|
|
},
|
|
{
|
|
"line": 340,
|
|
"text": " from torch.export.pt2_archive._package import load_pt2, PT2ArchiveContents"
|
|
},
|
|
{
|
|
"line": 343,
|
|
"text": " pt2_contents = load_pt2("
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"path": "/usr/local/lib/python3.12/site-packages/torch/export/pt2_archive/_package.py",
|
|
"exists": true,
|
|
"sha256": "7d243aaaed0e9b613b96dc5addebd239b3d4fe5de46467b5dce591fb6560c0eb",
|
|
"matches": [
|
|
{
|
|
"line": 892,
|
|
"text": " io.BytesIO(weight_bytes), weights_only=False"
|
|
},
|
|
{
|
|
"line": 950,
|
|
"text": " io.BytesIO(constant_bytes), weights_only=False"
|
|
},
|
|
{
|
|
"line": 978,
|
|
"text": " constants[constant_fqn] = pickle.loads(constant_bytes)"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"modelInventoryEvidence": {
|
|
"allPathsArtifact": ".artifacts/p9-sec-02/current-source/captured-source.json",
|
|
"installedModelPythonFiles": 2159,
|
|
"conversionPaths": [
|
|
"transformers/models/gemma4_unified/convert_gemma4_unified_weights.py"
|
|
],
|
|
"transformerXlFiles": [],
|
|
"glm4Present": true,
|
|
"perceiverPresent": true,
|
|
"seq2seqMappingContainsGlm4": false,
|
|
"seq2seqMappingContainsPerceiver": false
|
|
},
|
|
"scopeDispositionCounts": {
|
|
"Not affected with evidence": 10
|
|
},
|
|
"accounting": "These10 groups are a subset of the existing44, themselves remaining from109 original =65 prior removals+44. Ten scoped non-applicability assessments are not ten newly vendor-patched CVEs, and no alias groups are dropped. Candidate graph zero provider matches must remain separate from these qualitative conclusions.",
|
|
"remainingUncertainties": [
|
|
"CVE2025-55554 upstream open issue vs provider fixed event unresolved; no universal native numerical correctness or upstream patch proof.",
|
|
"Exact functions for ZDI GLM4/Perceiver reports are not specified by refreshed primary text; exclusion is named-family/loader scope, not universal deserialization safety.",
|
|
"No guarantee of new cache immutability or full-model SHA integrity from a pinned revision alone.",
|
|
"No full1.22GB selected model inference, GPU, production or deployed artifact qualification.",
|
|
"This lane did not make new provider queries; earlier captured vendor/OSV refresh is referenced."
|
|
],
|
|
"advisories": [
|
|
{
|
|
"groupId": "CVE-2025-55554",
|
|
"identifiers": [
|
|
"BIT-pytorch-2025-55554",
|
|
"CVE-2025-55554",
|
|
"PYSEC-2025-206"
|
|
],
|
|
"package": "torch",
|
|
"function": "nan_to_num followed by .long numeric/compiler mismatch",
|
|
"oldResearchDisposition": "Unresolved",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "Provider2.9 fixed event conflicts with open vendor issue; no global fix verified here.",
|
|
"currentRuntimeVersion": "2.13.0+cpu",
|
|
"installedLocator": "torch/_torch_docs.py",
|
|
"actualServiceReachability": "Current BART forward, generation utils, logits processors and generation config sources contain ZERO nan_to_num calls. Beam search3278 invokes the model,3295 uses float log_softmax,3020 chooses topk indices,3023/3026 derive beam/token IDs by integer division/modulo; it does not cast sanitized float scores to long. Existing .long calls convert attention masks/beam masks, not nan_to_num results. CPU auto-compile criteria2052 exclude CPU unless explicit _compile_all_devices is configured; app passes no compile configuration. remove_invalid_values defaultsFalse and even its optional processor1674-1678 uses torch.where returning float scores, with no long cast.",
|
|
"scopeLimit": "Upstream issue151510 remains open and no global fix is verified. Named operation chain is excluded from this exact CPU BART entry-point; this does not prove all native numerical code correct or full trained-model inference qualified.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc",
|
|
"https://github.com/pytorch/pytorch/issues/151510"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-206",
|
|
"retrievedUtc": "2026-10-25T06:30:29.565750+00:00",
|
|
"status": 200,
|
|
"sha256": "64f672cb98dbb7b9ef047f28dda45ac9a6c4336c8329dbf77b62dfbb172c4595",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-206-osv-50a92b9d.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2026-4538",
|
|
"identifiers": [
|
|
"BIT-pytorch-2026-4538",
|
|
"CVE-2026-4538",
|
|
"PYSEC-2026-139"
|
|
],
|
|
"package": "torch",
|
|
"function": "torch.export.load .pt2 unsafe deserialization",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "2.13.0+cpu",
|
|
"installedLocator": "torch/export",
|
|
"actualServiceReachability": "Current2.13 export.load283 still calls load_pt2; pt2_archive/_package.py891-892 and949-950 explicitly load weights_only=False and978 calls pickle.loads. This is real retained unsafe functionality. App.from_pretrained uses Transformers load_state_dict337, whose .bin fallback384 calls torch.load(weights_only=weights_only); app explicitly supplies True. Neither app nor parser accepts .pt2 model uploads or calls export.load.",
|
|
"scopeLimit": "Do not equate ordinary torch.load(.bin,weights_only=True) with torch.export.load(.pt2). No full checkpoint is needed to prove these distinct entry points; adding export/compile/package APIs invalidates the scoped exemption.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://github.com/pytorch/pytorch/",
|
|
"https://github.com/pytorch/pytorch/pull/176791",
|
|
"https://vuldb.com/?ctiid.352326",
|
|
"https://vuldb.com/?id.352326",
|
|
"https://vuldb.com/?submit.774681"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2026-139",
|
|
"retrievedUtc": "2026-10-25T06:30:29.927389+00:00",
|
|
"status": 200,
|
|
"sha256": "e67ea61edf63c4185e0bd1bbd16bfe0962a7c9197a538d5cb30a3c1a5513b194",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2026-139-osv-434604ef.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14929",
|
|
"identifiers": [
|
|
"CVE-2025-14929",
|
|
"PYSEC-2025-217"
|
|
],
|
|
"package": "transformers",
|
|
"function": "X-CLIP checkpoint conversion",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "convert_x_clip_original_pytorch_to_hf.py",
|
|
"actualServiceReachability": "Five named conversion CLIs are absent from the actual5.10 wheel, including X-CLIP. The sole installed conversion script is unrelated Gemma4. AutoModelForSeq2SeqLM.from_pretrained selects an existing BART class, not a conversion script. HTTP text/uploads cannot choose an X-CLIP checkpoint conversion command.",
|
|
"scopeLimit": "Named script absent; no new global vendor fix claim.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-217",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1144/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-217",
|
|
"retrievedUtc": "2026-10-25T06:30:30.374924+00:00",
|
|
"status": 200,
|
|
"sha256": "3adf5df151de0a18f3feadfd2650ba305d3f237118ed1b132f2e842257b1e49d",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-217-osv-ff71c1e4.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1144/",
|
|
"retrievedUtc": "2026-10-25T06:30:30.509603+00:00",
|
|
"status": 200,
|
|
"sha256": "10b152510a354035579bbe5105a655b2d6ce68300b01b6986cf67713984d372d",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14929-vendor-4dd379a6.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14926",
|
|
"identifiers": [
|
|
"CVE-2025-14926",
|
|
"PYSEC-2025-214"
|
|
],
|
|
"package": "transformers",
|
|
"function": "SEW convert_config eval",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "convert_sew_original_pytorch_checkpoint_to_pytorch.py",
|
|
"actualServiceReachability": "SEW conversion script is absent. BART model initialization does not run SEW convert_config, and the service accepts no converter/model-path arguments.",
|
|
"scopeLimit": "Named script absent; arbitrary operator-installed conversion tooling is outside this image scope.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-214",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1147/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-214",
|
|
"retrievedUtc": "2026-10-25T06:30:30.673882+00:00",
|
|
"status": 200,
|
|
"sha256": "97107fe171dd25eab53fecd583360fe9ce08a47076accf5200e085abd645fde1",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-214-osv-b2482d71.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/",
|
|
"retrievedUtc": "2026-10-25T06:30:30.686526+00:00",
|
|
"status": 200,
|
|
"sha256": "6d707a24d8e132cf52688fedbc0b8b9e132cf5c6432e35e85ac3f2cb8563692f",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14926-vendor-445e796e.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14930",
|
|
"identifiers": [
|
|
"CVE-2025-14930",
|
|
"PYSEC-2025-218"
|
|
],
|
|
"package": "transformers",
|
|
"function": "GLM4 weight parsing/deserialization",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "glm4",
|
|
"actualServiceReachability": "Unlike4.48.3, GLM4 modules are present in5.10. Its Glm4ForCausalLM maps to a different AutoModel family; GLM4 is absent from the seq2seq mapping. Verified pinned config declares model_type=bart and BartForConditionalGeneration. Request text cannot change config/model family.",
|
|
"scopeLimit": "Do not claim GLM4 code is absent or globally fixed. ZDI does not identify a precise loader function; conclusion is family/entry-point separation only.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-218",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1145/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-218",
|
|
"retrievedUtc": "2026-10-25T06:30:30.806213+00:00",
|
|
"status": 200,
|
|
"sha256": "ed2ea88b7e2a423d042ff44b2fc8678373c846ed89b52174d8f3a80001e30b6c",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-218-osv-b3d3148b.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/",
|
|
"retrievedUtc": "2026-10-25T06:30:30.977097+00:00",
|
|
"status": 200,
|
|
"sha256": "bd9c6966ace3e07e059e46e2e475d2a35e9b31b8d219692c1e8d25ca6ed3bbc9",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14930-vendor-174b1aa2.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14920",
|
|
"identifiers": [
|
|
"CVE-2025-14920",
|
|
"PYSEC-2025-211"
|
|
],
|
|
"package": "transformers",
|
|
"function": "Perceiver model-file deserialization",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "perceiver",
|
|
"actualServiceReachability": "Perceiver modules remain installed. Perceiver appears in generic/masked-LM/classification mappings, but not AutoModelForSeq2SeqLM mapping. Verified pinned BART config selects BART. BART tokenizer/generate do not dispatch Perceiver model parsing.",
|
|
"scopeLimit": "ZDI mechanism is broad; the scoped finding excludes its named architecture, not all deserialization. Shared torch.load boundary is separately patched/qualified, never assumed harmless.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-211",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1150/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-211",
|
|
"retrievedUtc": "2026-10-25T06:30:30.981107+00:00",
|
|
"status": 200,
|
|
"sha256": "b1ad7651e401afe2f018a894233927f5e3ffc74713eff8c92f9b67010506c915",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-211-osv-46b72aed.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1150/",
|
|
"retrievedUtc": "2026-10-25T06:30:31.016057+00:00",
|
|
"status": 200,
|
|
"sha256": "29ee25a4f04f0c1dcd8f7c8d726f0709a189ce4fc685f0e69dff0a581f740795",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14920-vendor-0db1197c.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14921",
|
|
"identifiers": [
|
|
"CVE-2025-14921",
|
|
"PYSEC-2025-212"
|
|
],
|
|
"package": "transformers",
|
|
"function": "Transformer-XL tokenizer/model pickle loading",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "transfo_xl",
|
|
"actualServiceReachability": "Actual5.10 installed model inventory contains no transfo_xl package/files. The old4.48.3 unsafe TransfoXL tokenizer path no longer exists. Selected tokenizer implementation is BART/RoBERTa backend, not a pickle vocabulary tokenizer.",
|
|
"scopeLimit": "Code removal from this wheel is direct current-source evidence; it does not establish an upstream CVE patch release for every distribution.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-212",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1149/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-212",
|
|
"retrievedUtc": "2026-10-25T06:30:31.278789+00:00",
|
|
"status": 200,
|
|
"sha256": "4ddc0cacf64df0a185a7f9ed7efd8ab925f47415e7a5d16ef6c0cfe46f39c175",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-212-osv-46f45372.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1149/",
|
|
"retrievedUtc": "2026-10-25T06:30:31.328648+00:00",
|
|
"status": 200,
|
|
"sha256": "ad3fe799fe57f7ca2c4f6801b73909ad04f6e18df1605f414e29072c99bfa69c",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14921-vendor-f87260aa.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14924",
|
|
"identifiers": [
|
|
"CVE-2025-14924",
|
|
"PYSEC-2025-213"
|
|
],
|
|
"package": "transformers",
|
|
"function": "Megatron-GPT2 checkpoint conversion",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "convert_megatron_gpt2_checkpoint.py",
|
|
"actualServiceReachability": "Megatron conversion script is absent from5.10 wheel. Fixed BART loader consumes standard weights, not converter CLI inputs or Megatron checkpoint arguments.",
|
|
"scopeLimit": "General BART .bin loading still uses torch.load; this is a distinct patched weights_only boundary and not a Megatron conversion exemption for all code.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-213",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1141/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-213",
|
|
"retrievedUtc": "2026-10-25T06:30:31.559012+00:00",
|
|
"status": 200,
|
|
"sha256": "0ba1b14fb5c727d9941c5df62d97d5cb8a7407e0af2fcc7e8bad140d2a945f6f",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-213-osv-e1a15253.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1141/",
|
|
"retrievedUtc": "2026-10-25T06:30:31.849765+00:00",
|
|
"status": 200,
|
|
"sha256": "14c885de463b5256fb9045a97c1025b906961eeedd8006043fcded26a1f5d25e",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14924-vendor-6bff1021.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14927",
|
|
"identifiers": [
|
|
"CVE-2025-14927",
|
|
"PYSEC-2025-215"
|
|
],
|
|
"package": "transformers",
|
|
"function": "SEW-D convert_config eval",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "convert_sew_d_original_pytorch_checkpoint_to_pytorch.py",
|
|
"actualServiceReachability": "SEW-D conversion script absent. Auto seq2seq BART loader and request text do not invoke SEW-D convert_config or execute user conversion strings.",
|
|
"scopeLimit": "Reassess if conversion tooling or audio-model support added.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-215",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1148/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-215",
|
|
"retrievedUtc": "2026-10-25T06:30:32.212243+00:00",
|
|
"status": 200,
|
|
"sha256": "2980168df942462a444385ba8b6fedb3a98ccd7b1173fd0b8ab0bdc49e70f3ea",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-215-osv-5acad121.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/",
|
|
"retrievedUtc": "2026-10-25T06:30:32.407304+00:00",
|
|
"status": 200,
|
|
"sha256": "ff54a2f77f12e400ef72769849797a9300c0d2e54520bdbbf26430bab9c78fec",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14927-vendor-a5b776ab.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
},
|
|
{
|
|
"groupId": "CVE-2025-14928",
|
|
"identifiers": [
|
|
"CVE-2025-14928",
|
|
"PYSEC-2025-216"
|
|
],
|
|
"package": "transformers",
|
|
"function": "HuBERT convert_config eval",
|
|
"oldResearchDisposition": "No fix",
|
|
"currentScopedDisposition": "Not affected with evidence",
|
|
"upstreamPatchStatus": "No released fix verified from primary advisory refresh; preserved independently of scoped service applicability.",
|
|
"currentRuntimeVersion": "5.10.0",
|
|
"installedLocator": "convert_hubert_original_pytorch_checkpoint_to_pytorch.py",
|
|
"actualServiceReachability": "HuBERT conversion script absent. App exposes fixed BART text generation and separate PIL/Tesseract/pypdf extraction; no HuBERT audio conversion route.",
|
|
"scopeLimit": "No global vendor fix claim; boundary is named converter absence plus fixed BART dispatch.",
|
|
"scope": "Exact locally built Linux CPU image/app flow, pinned verified BART config/tokenizer and supplied HTTP text/document routes. Excludes arbitrary operator Python, new models/converters/export APIs, mutable-cache compromise or other images.",
|
|
"confidence": "High for current image filesystem inventory, fixed app API and mapping separation. Does not certify full model runtime/quality or hostile-cache robustness.",
|
|
"primaryAdvisorySources": [
|
|
"https://osv.dev/vulnerability/PYSEC-2025-216",
|
|
"https://www.zerodayinitiative.com/advisories/ZDI-25-1146/"
|
|
],
|
|
"priorRefreshEvidence": [
|
|
{
|
|
"url": "https://api.osv.dev/v1/vulns/PYSEC-2025-216",
|
|
"retrievedUtc": "2026-10-25T06:30:32.498018+00:00",
|
|
"status": 200,
|
|
"sha256": "260b9ce87788db46ff1336dc4ae59474da75dbd673c5ca779ef20487d22123bb",
|
|
"contentType": "application/json",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/PYSEC-2025-216-osv-a41da499.raw"
|
|
},
|
|
{
|
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/",
|
|
"retrievedUtc": "2026-10-25T06:30:32.737570+00:00",
|
|
"status": 200,
|
|
"sha256": "5baa635ef760b47a023eb0332811f4b041403bac722c7d4202a59cd8c9c9c4de",
|
|
"contentType": "text/html; charset=utf-8",
|
|
"file": ".artifacts/p9-sec-02/advisory-research/CVE-2025-14928-vendor-f5b408f5.raw"
|
|
}
|
|
],
|
|
"publishedSeverityLabels": [],
|
|
"severityTreatment": "Published severity retained; scoped applicability classification is not severity reduction or owner acceptance.",
|
|
"reopenWhen": [
|
|
"Model repository/revision/family, tokenizer class, runtime image or package wheel changes.",
|
|
"New conversion/export/PT2/native graph input accepted.",
|
|
"Untrusted caller can alter loader kwargs, config, package files or model cache."
|
|
],
|
|
"verificationRequiredForBroaderClaim": "Full pinned1.22GB DistilBART weights/import/generation/resources/semantic checks remain unrun; would not itself prove global upstream fix."
|
|
}
|
|
]
|
|
}
|