Is CVE-2023-6730 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-6730 being exploited in the wild.

How severe is CVE-2023-6730?

Low severity, with a CVSS score of 3.1, published 19 December 2023.

Which products and versions are affected?

Hugging Face Transformers 0 to 4.35.2; transformers (PyPI) GIT:introduced=0,fixed=1d63b0ec361e7a38f1339385e8a5a855085532ce|ECOSYSTEM:introduced=0,fixed=4.36.0.

Is there a fix for CVE-2023-6730?

Yes. transformers (PyPI): upgrade to 4.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-6730 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-6730?

Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-6730: PYSEC-2023-300 - Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

CVE-2023-6730 · Severity: low · CVSS 3.1 · Published 2023-12-19

The transformers library, a widely-used Python package for machine learning model handling, contains a vulnerability that allows arbitrary code execution through unsafe deserialization of untrusted data. An attacker with limited privileges who tricks a user into loading a malicious model file can execute arbitrary code with the user's permissions, potentially compromising AI/ML pipelines and sensitive data.

Technologies: Hugging Face Transformers, transformers (PyPI). Vendors: Hugging Face, PyPI.

Quick answers

Is CVE-2023-6730 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-6730 being exploited in the wild.
How severe is CVE-2023-6730?: Low severity, with a CVSS score of 3.1, published 19 December 2023.
Which products and versions are affected?: Hugging Face Transformers 0 to 4.35.2; transformers (PyPI) GIT:introduced=0,fixed=1d63b0ec361e7a38f1339385e8a5a855085532ce|ECOSYSTEM:introduced=0,fixed=4.36.0.
Is there a fix for CVE-2023-6730?: Yes. transformers (PyPI): upgrade to 4.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-6730 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-6730?: Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

transformers (PyPI): upgrade to 4.36.0 or later
```
pip install "transformers>=4.36.0"
```

Technical details

The vulnerability (CWE-502) involves unsafe use of pickle.load() on untrusted model files without proper validation. The vulnerable code deserializes pickle-formatted model artifacts from remote sources or user-supplied files without requiring explicit trust declarations. An attacker can craft a malicious pickle file that executes arbitrary Python code during deserialization. The fix restricts pickle.load() to require the TRUST_REMOTE_CODE environment variable be set to True, forcing developers to explicitly opt-in to loading untrusted models. The vulnerability affects all versions prior to 4.36.0, and requires low privileges and user interaction (loading a remote model).

Affected products

Hugging Face transformers 0 to 4.35.2

Identifiers

CVE-2023-6730
GHSA-3863-2447-669p
PYSEC-2023-300

Timeline

2023-12-19: disclosed
2023-12-04: patched: Fix committed; version 4.36.0 released with patch

References

https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.