Tensorlayer
Monthly
Deserialization of untrusted data in TensorLayer up to 2.2.4 allows local code execution when a victim loads a malicious HDF5 model file via load_hdf5_graph(), requiring user interaction (UI:R) but no privileges (PR:N). Despite high potential impact (C:H/I:H/A:H per our assessed CVSS 3.1 vector), the official CVSS 4.0 score is only 2.1 (low) because it assumes a network vector, and operational priority is LOW since the flaw is not reachable in unattended network services. A publicly available exploit exists; the vendor has not responded to the issue report, and no patch is available.
Deserialization of untrusted data in TensorLayer up to 2.2.4 allows local code execution when a victim loads a malicious HDF5 model file via load_hdf5_graph(), requiring user interaction (UI:R) but no privileges (PR:N). Despite high potential impact (C:H/I:H/A:H per our assessed CVSS 3.1 vector), the official CVSS 4.0 score is only 2.1 (low) because it assumes a network vector, and operational priority is LOW since the flaw is not reachable in unattended network services. A publicly available exploit exists; the vendor has not responded to the issue report, and no patch is available.