repository icon
huggingface / transformers Project repository

🤗 Transformers: State-of-the-art Machine Learning for Pytorch, TensorFlow, and JAX.

Submit a report

FIRST INTERACTION

WITHIN5 DAYS

REVIEW

WITHIN5 DAYS

FIX

WITHINN/A DAYS

ReDoS in PPFormulaNetProcessor.post_process_generation (transformers)
jhc56
self closed
OneFormer image processor resolves class-info metadata from a mutable Hub source...
samyamaai
self closed
OneFormer image processor resolves class-info metadata from a mutable Hub source...
samyamaai
self closed
Test repo check - transformers
ripp3rdoc
self closed
Server-Side Request Forgery via Unvalidated Media URLs in transformers serve Mul...
ripp3rdoc
self closed
Unbounded Lock Retention in load_model via Unique Model IDs Memory Growth DoS in...
hombecl
self closed
Unbounded Lock Retention in load_model via Unique Model IDs Memory Growth DoS
hombecl
self closed
Unbounded Lock Retention in load_model via Unique Model IDs Leads to Persistent...
hombecl
self closed
RCE: AutoModel from_pretrained() silently loads and executes an untrusted PEFT a...
linziyuu
self closed
ProcessorMixin confused-deputy RCE
eunhokim98
self closed
Arbitrary File Write via Path Traversal in Multi Chat Template Names
usernamebiasa
duplicate
Medium
Path Traversal in Sharded Checkpoint Loading via Malicious weight_map Index
wulonchia-pro
self closed
transformers serve: POST /load_model + /reset bypass --force-model pin enforceme...
nahldi
self closed
SSRF in image_utils.py load_image allows access to internal network and local fi...
galanzi2580-wq
informative
None
Malicious AI model templates can freeze servers with exponentially expanding loo...
quintessence-proof
informative
High
SSRF in image, audio, and video URL loading: httpx.get with no URL validation an...
hoangperry
informative
Medium
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
Unbounded max_new_tokens in Generation Configuration Leads to Denial of Service
galanzi2580-wq
informative
None
cors_misconfiguration in src/transformers/cli/serving/server.py:80
muraveyapp
informative
High
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
User-controlled data passed to a template rendering function. An attacker can in...
muraveyapp
informative
Critical
Denial of Service in Transformers via unvalidated num_attention_heads configurat...
louisrodriguez1990-crypto
informative
Medium
SSRF in transformers load_image / load_image_as_tensor (and audio_utils) via unr...
boke-kun
informative
Medium
ReDoS via attacker-controlled response_schema in chat response parsing (recursiv...
pablofd
informative
Medium
SSRF via httpx.get(follow_redirects=True) in audio and image pipeline loaders
thesecguy45
informative
Medium
ReDoS via attacker-controlled quantization module-skip patterns in huggingface/t...
pablofd
informative
Medium
huntr: huggingface/transformers