Executive brief
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Affected products
- PyPI transformers
Junglewise Threat Intelligence
CVE-2023-7018: PYSEC-2023-301 - Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
CVE-2023-7018 · Severity: low · CVSS 3.1 · Published 2023-12-20
Technologies: transformers (PyPI). Vendors: PyPI.
Related threats
- A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. Th
- PYSEC-2026-1980 - Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
- PYSEC-2026-1988 - Hugging Face Transformers library has Regular Expression Denial of Service
- PYSEC-2026-1981 - Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
- PYSEC-2026-1983 - Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability