Headline
GHSA-47fc-vmwq-366v: PyTorch vulnerable to arbitrary code execution
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. The fix for this issue is planned to be released in version 1.13.1, there is a release checker in issue #89855.
PyTorch vulnerable to arbitrary code execution
Critical severity GitHub Reviewed Published Nov 26, 2022 • Updated Dec 2, 2022
Related news
CVE-2022-45907: [JIT][Security] Do not blindly eval input string (#89189) · pytorch/pytorch@767f6aa
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.