CVE-2023-2800

Description

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.

How to fix CVE-2023-2800

To remediate CVE-2023-2800, upgrade the affected package to a fixed version below.

• PyPI/transformers—upgrade to 4.30.0 or later
• PyPI/transformers—upgrade to 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 or later

Is CVE-2023-2800 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 4.30.0
• from 0, < 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 | from 0, < 4.30.0

CVSS scores

References (7)

• ADVISORYgithub.com/advisories/GHSA-282v-666c-3fvg
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-2800
• PATCHgithub.com/huggingface/transformers
• WEBgithub.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43