Skip to content

Security: transformers cap leaves affected versions reachable in local model bridges #2289

Description

@hamizan-azman

Summary

The current dependency cap allows affected transformers versions to remain installable from the main requirements file:

  • Current dependency line:
    transformers>=4.27.1,<4.42
  • Declared range: transformers>=4.27.1,<4.42
  • Resolver result checked from that range: transformers==4.41.2

That resolved version is below the patched versions for these public advisories:

Source paths to review

The project has several local model bridges that load Transformers models or tokenizers with trust_remote_code=True, for example:

Local validation notes

With transformers==4.41.2, I reproduced the library-level behavior behind the two advisories in a local test environment:

  • For GHSA-hxxf-235m-72v3, the TransfoXL tokenizer pickle path was blocked in the default mode, but reached a synthetic local marker payload when trusted remote-code mode was enabled.
  • For GHSA-jjph-296x-mrcr, get_imports() showed rapidly increasing runtime on crafted input: about 0.037s at size 100, 0.808s at size 500, 2.835s at size 1000, and timeout at size 2000 in the local bounded probe.

This report is scoped to the vulnerable dependency cap plus the current source paths that opt into trusted Transformers model code. It is not a claim of a full unauthenticated application exploit.

Suggested fix

Please consider removing the <4.42 cap and requiring a Transformers version at or above 4.51.0 if compatible, or another current compatible release line that includes the fixes above. The optional ChatGLM4 requirements file already has a looser transformers>=4.44 line, so it may also be worth aligning the main requirements with the maintained path.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions