CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerability

What it is

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0.

How to check

1. Affected: transformers (pip) < 4.36.0.
2. Compare your installed version with the range above (command below).

How to fix

1. Upgrade transformers to 4.36.0 or later.

pip show transformers | grep Version

Sources

• GitHub Security Advisory GHSA-3863-2447-669p ↗
• NVD: CVE-2023-6730 ↗