CVE-2023-2800

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-377

Affected software

Vendor	Product	Versions
huggingface	huggingface/transformers	>= unspecified, < 4.30.0

References

https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43Patch
https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44aExploit, Patch, Third Party Advisory
https://github.com/huggingface/transformers/commit/80ca92470938bbcc348e2d9cf4734c7c25cb1c43Patch
https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e7084a44aExploit, Patch, Third Party Advisory

Timeline

Published: May 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-280007.8An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.CVE-2023-280019.8An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or c CVE-2023-280026.7An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versio CVE-2023-280038.8A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked CVE-2023-280049.8A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial of s CVE-2023-280056.8A vulnerability in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and below could allow an attacker with physical a CVE-2023-280067.8The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.CVE-2023-280088.1HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remot CVE-2023-280098.1HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp CVE-2023-28015.3Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data source CVE-2023-280105.3In some configuration scenarios, the Domino server host name can be exposed. This information could be used to target future attacks.CVE-2023-280128.8HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI ser