Description
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| huggingface | huggingface/transformers | unspecified – < 4.36 | 4.36 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | transformers | < 4.36.0 | 4.36.0 | GHSA-3863-2447-669p |