Aspect-Based-Sentiment-Analysis
Aspect-Based-Sentiment-Analysis copied to clipboard
ScalaConsultants
transformers-4.8.2-py3-none-any.whl: 10 vulnerabilities (highest severity is: 8.8)
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (transformers version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2024-11394 |  High |
8.8 | transformers-4.8.2-py3-none-any.whl | Direct | 4.48.0 | ✅ |
| CVE-2024-11393 | High |
8.8 | transformers-4.8.2-py3-none-any.whl | Direct | 4.48.0 | ✅ |
| CVE-2024-11392 | High |
8.8 | transformers-4.8.2-py3-none-any.whl | Direct | 4.48.0 | ✅ |
| CVE-2023-6730 | High |
8.8 | transformers-4.8.2-py3-none-any.whl | Direct | 4.36.0 | ✅ |
| CVE-2023-7018 | High |
7.8 | transformers-4.8.2-py3-none-any.whl | Direct | 4.36.0 | ✅ |
| CVE-2025-2099 | High |
7.5 | transformers-4.8.2-py3-none-any.whl | Direct | 4.50.0 | ✅ |
| CVE-2024-12720 |  Medium |
5.3 | transformers-4.8.2-py3-none-any.whl | Direct | 4.48.0 | ✅ |
| CVE-2023-2800 | Medium |
4.7 | transformers-4.8.2-py3-none-any.whl | Direct | 4.30.0 | ✅ |
| CVE-2025-1194 | Medium |
4.3 | transformers-4.8.2-py3-none-any.whl | Direct | transformers - 4.50.0 | ✅ |
| CVE-2024-3568 |  Low |
3.4 | transformers-4.8.2-py3-none-any.whl | Direct | 4.38.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-11394
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25012.
Publish Date: 2024-11-22
URL: CVE-2024-11394
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-11394
Release Date: 2024-11-22
Fix Resolution: 4.48.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-11393
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25191.
Publish Date: 2024-11-22
URL: CVE-2024-11393
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-11393
Release Date: 2024-11-22
Fix Resolution: 4.48.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-11392
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-24322.
Publish Date: 2024-11-22
URL: CVE-2024-11392
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2024-11-22
Fix Resolution: 4.48.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-6730
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Publish Date: 2023-12-19
URL: CVE-2023-6730
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16/
Release Date: 2023-12-19
Fix Resolution: 4.36.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-7018
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Publish Date: 2023-12-20
URL: CVE-2023-7018
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-7018
Release Date: 2023-12-20
Fix Resolution: 4.36.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2025-2099
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
A vulnerability in the "preprocess_string()" function of the "transformers.testing_utils" module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.
Publish Date: 2025-05-19
URL: CVE-2025-2099
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-qq3j-4f4f-9583
Release Date: 2025-05-19
Fix Resolution: 4.50.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-12720
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).
Publish Date: 2025-03-20
URL: CVE-2024-12720
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2025-03-20
Fix Resolution: 4.48.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-2800
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
Publish Date: 2023-05-18
URL: CVE-2023-2800
CVSS 3 Score Details (4.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a/
Release Date: 2023-05-18
Fix Resolution: 4.30.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2025-1194
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file "tokenization_gpt_neox_japanese.py" of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).
Publish Date: 2025-04-29
URL: CVE-2025-1194
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-fpwr-67px-3qhx
Release Date: 2025-04-29
Fix Resolution: transformers - 4.50.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-3568
Vulnerable Library - transformers-4.8.2-py3-none-any.whl
State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow
Library home page: https://files.pythonhosted.org/packages/fd/1a/41c644c963249fd7f3836d926afa1e3f1cc234a1c40d80c5f03ad8f6f1b2/transformers-4.8.2-py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis
Path to vulnerable library: /tmp/ws-scm/Aspect-Based-Sentiment-Analysis,/.ws-temp-THFHIH-requirements.txt
Dependency Hierarchy:
- :x: transformers-4.8.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: d952432cb8d2cb53d7a0c189dc2d16fc535cdc75
Found in base branch: master
Vulnerability Details
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the "load_repo_checkpoint()" function of the "TFPreTrainedModel()" class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of "pickle.load()" on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.
Publish Date: 2024-04-10
URL: CVE-2024-3568
CVSS 3 Score Details (3.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-3568
Release Date: 2024-04-10
Fix Resolution: 4.38.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.
![mend-for-github-com[bot] avatar](https://avatars.githubusercontent.com/in/30796?v=4 "Published by a pub.dev verified publisher"){kind=small}