Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
PyPI transformers · Upgrade to 5.10.0 or later · < 5.10.0 · CVE-2026-9856 · GHSA-xrqw-3rrv-vx5w
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–2 of 2 matching · newest first
PyPI transformers · Upgrade to 5.10.0 or later · < 5.10.0 · CVE-2026-9856 · GHSA-xrqw-3rrv-vx5w
PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-9335 · GHSA-m8wh-29wm-52mv
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.