Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.7

Transformers library can expose data via unsafe temp files

CVE-2023-2800 · published 3 years ago
Summary

The Hugging Face Transformers code created temporary files in a way that other programs on the same system could read them before they were deleted. This could allow sensitive data used by the library to be seen by unauthorized users. Update the library to version 4.30.0 or newer to fix the issue.

What to do
  • Update the hugging face team (past and future) with the help of all our contributors (https://github.com/huggingface/transformers/graphs/contributors) transformers to version 4.30.0.
  • Update huggingface transformers to version 4.30.0 or later.
Affected software
Ecosystem VendorProductAffected versions
pip the hugging face team (past and future) with the help of all our contributors (https://github.com/huggingface/transformers/graphs/contributors) transformers < 4.30.0
Fix: upgrade to 4.30.0
– huggingface transformers < 4.30.0
cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*
Original advisory text
Insecure Temporary File in huggingface/transformers
Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.7 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-377Insecure Temporary File
Timeline
Published18 May 2023
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-282v-666c-3fvg · GHSA
CVE-2023-2800 · NVD
CVE-2023-2800 · OSV
Track software like this
Free during beta