Came across something in pytorch/Embedding/m3e_base/requirements.txt around line 2 that looked worth flagging.
The CVE describes a deserialization flaw in Hugging Face Transformers' MobileViTV2 handling, allowing remote code execution if a malicious configuration file is processed. This is a genuine high‑risk vulnerability in transformers <4.48.0, requiring code execution in the user's context. The fix is to upgrade to the patched version.
Something like this might fix it:
--- a/pytorch/Embedding/m3e_base/requirements.txt
+++ b/pytorch/Embedding/m3e_base/requirements.txt
@@ -1,3 +1,3 @@
# Example comment or other package
-transformers==4.44.0
+transformers==4.48.0
# Example comment or other package
For reference: rule CVE-2024-11392. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
pytorch/Embedding/m3e_base/requirements.txtaround line 2 that looked worth flagging.The CVE describes a deserialization flaw in Hugging Face Transformers' MobileViTV2 handling, allowing remote code execution if a malicious configuration file is processed. This is a genuine high‑risk vulnerability in transformers <4.48.0, requiring code execution in the user's context. The fix is to upgrade to the patched version.
Something like this might fix it:
For reference: rule
CVE-2024-11392. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.