π [IBM OSPO Security Notification] β IBM/FMFastSim
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- huggingface, python
- Domain
- machine-learning, security
Research direction
No dependency manifest or test file is named. Start by locating the declarations for torch and transformers, then review the listed CVEs and available patched versions; done means applying feasible updates and confirming the open Dependabot alerts are resolved, while documenting alerts with no available fix.
Written by the indexing model from the issue text.
Description
π [IBM OSPO Security Notification] β IBM/FMFastSim
Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only β
they will never trigger warnings or archiving.π‘ Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings β Advanced Security β Dependabot security updates β Enable.π New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.
Attention: @wgifford @kyongmin-yeo
Dependabot Alerts
| Severity | CVE/GHSA | Package | Affected | Patched | Deadline | Fix PR |
|---|---|---|---|---|---|---|
| π high | CVE-2026-4372 | transformers | < 5.3.0 | 5.3.0 | 2026-10-22 | β |
| π high | CVE-2026-5241 | transformers | < 5.5.0 | 5.5.0 | 2026-10-22 | β |
| π high | CVE-2026-9856 | transformers | < 5.10.0 | 5.10.0 | 2026-10-22 | β |
| π‘ medium | CVE-2025-3730 | torch | <= 2.7.1 | 2.8.0 | 2026-12-21 | β |
| π‘ medium | CVE-2026-1839 | transformers | < 5.0.0rc3 | 5.0.0rc3 | 2026-12-21 | β |
| π‘ medium | CVE-2025-2998 | torch | <= 2.6.0 | β | 2026-12-21 | β |
| π‘ medium | CVE-2025-2999 | torch | < 2.9.1 | 2.9.1 | 2026-12-21 | β |
| π΅ low | CVE-2025-2953 | torch | < 2.7.1-rc1 | 2.7.1-rc1 | β | β |
| π΅ low | CVE-2025-2148 | torch | <= 2.6.0 | β | β | β |
| π΅ low | CVE-2025-2149 | torch | <= 2.6.0 | β | β | β |
| π΅ low | CVE-2025-3001 | torch | < 2.10.0 | 2.10.0 | β | β |
| π΅ low | CVE-2025-3000 | torch | <= 2.12.1 | 2.13.0 | β | β |
Code Scanning Alerts
No open code scanning alerts.
Secret Scanning Alerts
No open secret scanning alerts.
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up β it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from IBM/FMFastSim
Similar issues
-
bug confirmed issue
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
open-webui/open-webui#30750 Β· 1 comment Β·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
OpenwaterHealth/openmotion-bloodflow-app#604 Β· 1 comment Β·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
LearningCircuit/local-deep-research#6766 Β·
-
good first issue
Difficulty 1/5 Under an hour Newbie friendliness 90/100