Security brief
Historical advisory: untrusted Transformers checkpoints could execute code
REVIEWA checkpoint-loading issue illustrates why model artefacts must be treated as untrusted inputs.
What happened
OSV’s April 2024 advisory describes unsafe deserialization in Transformers’ TensorFlow checkpoint-loading path. A malicious serialized checkpoint could execute code when a victim loaded it during training. The record identifies CVE-2024-3568 and lists 4.38.0 as fixed.
The important distinction is between downloading model data and executing a loader that interprets that data as code-capable objects. A familiar file extension does not establish safety.
For legacy training environments, review the installed Transformers version and the provenance of checkpoints. Use a supported patched release and isolate processing of untrusted artefacts. These are defensive precautions; the advisory does not establish that a specific checkpoint or deployment was compromised.
Who should check?
Teams loading TensorFlow checkpoints through older Transformers versions.
Next step
Review CVE-2024-3568 and update affected checkpoint-loading environments.
What we know
- Historical fixed version
- 4.38.0
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
OSV
Technical details
- CVE
CVE-2024-3568