CVE-2023-2800: Vulnerability in Transformers Package Due to Insecure Temporary File Handling
Summary
CVE-2023-2800: Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0. Affects transformers across 2 version ranges.
< 4.30.0
< 80ca92470938bbcc348e2d9cf4734c7c25cb1c43
Fixed in 80ca92470938bbcc348e2d9cf4734c7c25cb1c43. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Transformers package, developed by Hugging Face, is a widely-used library in the field of natural language processing (NLP). It provides state-of-the-art machine learning models for tasks such as text classification, translation, and summarization. The library is known for its ease of use and extensive documentation, making it a popular choice among developers and researchers. However, prior to version 4.30.0, the package had a vulnerability related to insecure temporary file handling, which could potentially expose sensitive data.
Vulnerability Detail
The vulnerability identified as CVE-2023-2800 arises from the use of insecure temporary files in the Transformers package. This issue can lead to unauthorized access to sensitive information, as temporary files may be created in a publicly accessible directory without proper permissions. Attackers could exploit this vulnerability to read or manipulate these files, resulting in data leakage or corruption. The vulnerability affects all versions of the package prior to 4.30.0, and it is crucial for users to address this issue to maintain the security of their applications.
How To Fix
Latest published version: 5.20.2 as of 22 Oct 2026
pip install --upgrade "transformers==5.20.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
80ca92470938bbcc348e2d9cf4734c7c25cb1c43
This is the first release that contains the fix.
pip install --upgrade "transformers==80ca92470938bbcc348e2d9cf4734c7c25cb1c43"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually ensure that any temporary files created by the Transformers package are stored in a secure directory with appropriate permissions. This can help mitigate the risk of unauthorized access until the package is updated.
Conclusion
CVE-2023-2800 is a significant vulnerability in the Transformers package that can lead to unauthorized access to sensitive information due to insecure temporary file handling. Users are strongly encouraged to update to version 4.30.0 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for transformers →
FAQ
CVE-2023-2800 is a vulnerability in the Transformers package that involves insecure handling of temporary files, potentially exposing sensitive data.
All versions of the Transformers package prior to 4.30.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.7, indicating a moderate level of severity.
If you cannot update the package immediately, ensure that any temporary files created by the package are stored securely and have appropriate permissions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for transformers.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
