repository icon
facebookresearch / fairseq Project repository

Facebook AI Research Sequence-to-Sequence Toolkit written in Python.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN9 DAYS

FIX

WITHINN/A DAYS

Remote code execution via unsafe pickle.loads() in distributed training all_gath...
snakeyworm
duplicate
None
RCE via torch.load(weights_only=False) and Arbitrary Module Import in facebookre...
sucloudflare
duplicate
High
Command injection via unsanitized CLI arguments interpolated into subprocess she...
elliottower
self closed
Arbitrary code execution via unsafe torch.load(weights_only=False) and unprotect...
pulkit7070
duplicate
High
Arbitrary Code Execution via unsafe deserialization in checkpoint loading (torch...
romain-deperne
duplicate
High
RCE via torch.load(weights_only=False) + pickle.loads() in checkpoints and distr...
nhomyk
duplicate
Critical
Unsafe torch.load() Across 4 fairseq Modules Enables RCE via Malicious Checkpoin...
odysseypro25-project
duplicate
Critical
Explicit weights_only=False in load_checkpoint_to_cpu() enables RCE via Remote C...
theoddesseyp-ai
duplicate
High
Arbitrary Code Execution via pickle.loads() on Untrusted Distributed Training Da...
theoddesseyp-ai
duplicate
High
SSRF via cached_path() downloading from user-controlled URLs in BPE/tokenizer co...
elucidator-hky
self closed
Arbitrary code execution via unsafe torch.load(weights_only=False) in fairseq ch...
elucidator-hky
self closed
Path traversal via tarfile.extractall() on archives downloaded from URLs in load...
avienma007
duplicate
Critical
Arbitrary Code Execution via eval() in Manifest File Parsing (5 instances)
jeremysommerfeld8910-cpu
self closed
Arbitrary File Write (Zip Slip) in `fairseq.hub_utils.from_pretrained` via `file...
zitoxxx
duplicate
High
Arbitrary Code Execution via eval() on Untrusted Manifest Data File Content in p...
phenggeler
pending
Additional RCE via Unsafe eval() in fairseq Core Library (28 Occurrences, 14 Fil...
responsiblereport10
pending
Command Injection via subprocess shell=True
responsiblereport10
pending
Arbitrary Code Execution via Unsafe PyTorch Model Deserialization
responsiblereport10
duplicate
High
Arbitrary Code Execution via Unsafe PyTorch Model Deserialization
responsiblereport10
duplicate
High
Unrestricted URL fetching in `cached_path` enables SSRF-style network access and...
f00dat
pending
Unsafe PyTorch checkpoint deserialization via `torch.load(..., weights_only=Fals...
f00dat
duplicate
Critical
Unsafe tar extraction allows path traversal and arbitrary file write
f00dat
duplicate
Critical
Arbitrary Code Execution via Insecure Model Loading in Fairseq
aydinnyunus
duplicate
High
Remote Code Execution in facebookresearch/fairseq via Unsafe Model Deserializati...
jonnylitten
pending
Remote Code Execution (RCE) via Unsafe eval() on CLI Argument in Fairseq Scripts
imshagufta
pending
Arbitrary Code Execution Leading to Arbitrary File Read via Fairseq's `--user-di...
theneelofficial
pending
Arbitrary File Write via Path Traversal
theneelofficial
pending
Path Traversal
sahiloj
pending
Remote Code Execution by Pickle Deserialization via distributed.utils.all_gather...
chenpinji
pending
Arbitrary File Overwrite in from_pretrained api
sunrisexu
duplicate
High
Code Injection via the _build_index() Function in the FastaDataset Class
williwollo
informative
Critical
Arbitrary File Write via Path Traversal
williwollo
informative
High
Arbitrary file write during tarfile extraction at file_utils
rook1337
informative
Critical