gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 23:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Document transformers CVE-2025-1194 is already fixed

Browse Source 
- Add comment explaining transformers >=4.53.0 is already safe (CVE fixed in >=4.50.0)
- Dependabot alert #31 is false positive due to missing lockfile
- No version change needed - current specification is already secure

Security Status:
- CVE-2025-1194: Fixed in transformers >=4.50.0, current spec >=4.53.0 ✓
- Affects: SubWordJapaneseTokenizer in GPT-NeoX-Japanese model
- Impact: ReDoS via crafted input causing exponential regex backtracking

Note: Without a lockfile (pip-tools/uv/poetry), Dependabot cannot determine
the installed version and raises alerts based on the requirement spec alone.
This commit is contained in:
TPTBusiness
2026-04-02 23:01:07 +02:00
parent f328f31450
commit 971d92d76f
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/scenarios/rl/autorl_bench/requirements.txt
+3 -2
View File
@@ -23,9 +23,10 @@ pydantic>=2.4.0 # Security fix: CVE-2024-3772 (ReDoS via crafted email)
# Models
# Security: transformers >=4.51.0 fixes CVE-2025-3263 (ReDoS in get_configuration_file)
# Current spec (>=4.53.0) is already safe. Dependabot alert is false positive due to missing lockfile.
# Security: transformers >=4.50.0 fixes CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer)
# Current spec (>=4.53.0) is already safe. Dependabot alerts are false positives due to missing lockfile.
torch>=2.8.0 # Security fix: CVE-2025-32434 (torch.load RCE), CVE-2025-3730 (DoS in ctc_loss)
transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051 (ReDoS)
transformers>=4.53.0 # Security fix: CVE-2024-11393 (RCE), CVE-2025-3264/3933/2099/6051/1194 (ReDoS)
huggingface_hub>=0.20.0
# Web services