-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| transformers | pip | < 4.38.0 | 4.38.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems directly from the removed load_repo_checkpoint method shown in the commit diff. This function contained unsafe pickle.load() deserialization of checkpoint data from external sources. The patch fixed the issue by removing this entire function, confirming it was the vulnerable component. The CWE-502 mapping and advisory descriptions explicitly reference this function's use of insecure deserialization as the attack vector.