Spotted what might be an issue in pytorch/Embedding/bge_reranker_large/requirements.txt around line 3.
CVE‑2024‑11393 is a deserialization vulnerability in Hugging Face Transformers (versions ≤4.44.0) that allows untrusted model files to be deserialized without validation. An attacker can craft a malicious model file that, when loaded, executes arbitrary code in the context of the current user. Exploitation requires user interaction (e.g., opening a malicious file or visiting a page), but the impact is remote code execution with the privileges of the application, posing a high risk.
Something like this might fix it:
--- a/pytorch/Embedding/bge_reranker_large/requirements.txt
+++ b/pytorch/Embedding/bge_reranker_large/requirements.txt
@@ -1,3 +1,3 @@
-transformers==4.44.0
+transformers==4.48.0
For reference: rule CVE-2024-11393. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
pytorch/Embedding/bge_reranker_large/requirements.txtaround line 3.CVE‑2024‑11393 is a deserialization vulnerability in Hugging Face Transformers (versions ≤4.44.0) that allows untrusted model files to be deserialized without validation. An attacker can craft a malicious model file that, when loaded, executes arbitrary code in the context of the current user. Exploitation requires user interaction (e.g., opening a malicious file or visiting a page), but the impact is remote code execution with the privileges of the application, posing a high risk.
Something like this might fix it:
For reference: rule
CVE-2024-11393. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.