Skip to content

Possible fix(deps): 2 vulnerable dependencies in requirements.txt #69

Description

@begininvoke

I think there may be a problem in pytorch/Embedding/bge_m3/requirements.txt around line 3.

The transformers library version 4.44.0 has a vulnerability (CVE-2026-5241) where LightGlue's model loading process improperly respects the trust_remote_code flag from untrusted config.json, allowing arbitrary code execution when loading a malicious model. This poses a high risk of credential theft, lateral movement, and persistence in environments like inference servers, notebooks, and CI/CD pipelines. Upgrading to version 5.5.0 or later mitigates this issue.

Something like this might fix it:

--- a/pytorch/Embedding/bge_m3/requirements.txt
+++ b/pytorch/Embedding/bge_m3/requirements.txt
@@
-    transformers==4.44.0
+    transformers==5.5.0

For reference: rule CVE-2026-5241. Rated high.

The suggested change is untested against this project, so please read it before applying it.


Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions