I think there may be a problem in pytorch/Embedding/bge_m3/requirements.txt around line 3.
The transformers library version 4.44.0 has a vulnerability (CVE-2026-5241) where LightGlue's model loading process improperly respects the trust_remote_code flag from untrusted config.json, allowing arbitrary code execution when loading a malicious model. This poses a high risk of credential theft, lateral movement, and persistence in environments like inference servers, notebooks, and CI/CD pipelines. Upgrading to version 5.5.0 or later mitigates this issue.
Something like this might fix it:
--- a/pytorch/Embedding/bge_m3/requirements.txt
+++ b/pytorch/Embedding/bge_m3/requirements.txt
@@
- transformers==4.44.0
+ transformers==5.5.0
For reference: rule CVE-2026-5241. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
pytorch/Embedding/bge_m3/requirements.txtaround line 3.The transformers library version 4.44.0 has a vulnerability (CVE-2026-5241) where LightGlue's model loading process improperly respects the trust_remote_code flag from untrusted config.json, allowing arbitrary code execution when loading a malicious model. This poses a high risk of credential theft, lateral movement, and persistence in environments like inference servers, notebooks, and CI/CD pipelines. Upgrading to version 5.5.0 or later mitigates this issue.
Something like this might fix it:
For reference: rule
CVE-2026-5241. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.