Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-v72p-1gy4-syck
Vulnerability ID VCID-v72p-1gy4-syck
Aliases CVE-2023-6730
GHSA-3863-2447-669p
PYSEC-2023-300
Summary Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-502 Deserialization of Untrusted Data
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-6730
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-6730
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-6730
epss 0.00161 https://api.first.org/data/v1/epss?cve=CVE-2023-6730
cvssv3.1 8.8 https://github.com/advisories/GHSA-3863-2447-669p
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-3863-2447-669p
cvssv3.1 9.0 https://github.com/huggingface/transformers
generic_textual CRITICAL https://github.com/huggingface/transformers
cvssv3.1 8.8 https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce
cvssv3.1 9.0 https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce
generic_textual CRITICAL https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce
cvssv3.1 9.0 https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2023-300.yaml
generic_textual CRITICAL https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2023-300.yaml
cvssv3.1 8.8 https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16
cvssv3.1 9.0 https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16
generic_textual CRITICAL https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16
cvssv3.1 9.0 https://nvd.nist.gov/vuln/detail/CVE-2023-6730
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2023-6730
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-6730
https://github.com/advisories/GHSA-3863-2447-669p
https://github.com/huggingface/transformers
https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce
https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2023-300.yaml
https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16
https://nvd.nist.gov/vuln/detail/CVE-2023-6730
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-3863-2447-669p
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/huggingface/transformers
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2023-300.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Found at https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-6730
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36823
EPSS Score 0.00161
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T21:01:33.757976+00:00 PyPI Importer Import https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.6.0