A path traversal vulnerability was found in the deepset-ai farm up to version 0.8.0, specifically in the WordEmbedding_LM.load function of the farm/modeling/language_model.py file. This issue allows local attackers to manipulate the embeddings_filename argument, potentially leading to unauthorized file access. The vulnerability has been publicly disclosed, and although the vendor was notified, they did no [truncated]
A path traversal vulnerability was found in deepset-ai farm up to 0.8.0, impacting the EmbeddingTokenizer.from_pretrained function in farm/modeling/tokenization.py. This issue allows remote attackers to manipulate the vocab_filename argument, potentially leading to path traversal attacks. The exploit has been published, and although the vendor was contacted, no response was received. This vulnerability af [truncated]
