CVSS 3.1
4.7 mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2023-2800
Medium (4.7) in huggingface transformers. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in transformers 4.30.0.
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
- CWE
- CWE-377
- Published
- Modified
- Record from
- the NVD, synced
Affected
- huggingface:transformers
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-282v-666c-3fvg | PyPI | transformers | <4.30.0 | 4.30.0 |
| PYSEC-2023-299 | PyPI | transformers | <4.30.0 | 4.30.0 |
References
- https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43
- https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a
- https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43
- https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44a