Colemurray

Name of the Vulnerable Software and Affected Versions HuggingFace Transformers versions prior to 5.0.0rc3 Description A flaw exists in the `Trainer` class within the HuggingFace Transformers library. The ` load rng state()` method, located in `src/transformers/trainer.py` at line 3059, utilizes `torch.load()` without the `weights only=True` parameter. This creates a risk of arbitrary code execution when using PyTorch versions below 2.6 and Transformers versions supporting `torch>=2.2`. An attacker can exploit this by providing a malicious checkpoint file, such as `rng state.pth`, which can execute arbitrary code upon loading. Recommendations Update to version 5.0.0rc3 or later.

**Name of the Vulnerable Software and Affected Versions** Eigent (affected versions not specified) **Description** A critical security flaw exists in the CI workflow file (.github/workflows/ci.yml). This flaw permits arbitrary code execution originating from pull requests submitted from forked repositories that possess repository write permissions. The vulnerability stems from the use of the `pull request target` trigger in conjunction with the checkout of code from untrusted pull requests. Exploitation could allow an attacker to steal credentials, post comments, push code, or create releases. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.