← Scan another repo

github.com/tensorflow/models

@ 4d7bdd8c170e

Submitted 8/4/2026, 10:25:56 AM · Status: ok

Risk grade
F
100 / 100
Findings
380
0 critical64 high281 medium15 low20 info0 on CISA KEV0ATT&CK
Showing 380 of 380 findings

Findings

  • Detected algolia-api-key: Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms
    Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms.
    gitleaks
  • FITS GZIP decompression bomb in Pillow
    grypeCVE-2026-40192EPSS 0.7%
  • opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
    grype
  • Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
    grypeCVE-2026-55379EPSS 0.4%
  • Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
    grypeCVE-2026-55380EPSS 0.4%
  • Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
    grypeCVE-2026-54059EPSS 0.4%
  • Pillow affected by out-of-bounds write when loading PSD images
    grypeCVE-2026-25990EPSS 0.4%
  • Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
    grypeCVE-2026-42311EPSS 0.1%
  • Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
    grypeCVE-2026-59204EPSS 0.4%
  • Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
    grypeCVE-2026-54060EPSS 0.4%
  • Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
    grypeCVE-2026-59205EPSS 0.4%
  • Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
    grypeCVE-2026-59200EPSS 0.4%
  • Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
    grypeCVE-2026-59199EPSS 0.4%
  • Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
    grypeCVE-2026-59197EPSS 0.4%
  • Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
    grypeCVE-2026-54058EPSS 0.4%
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepresearch/cognitive_planning/viz_active_vision_dataset_main.py:269
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepofficial/legacy/xlnet/run_squad.py:259
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/rebar/datasets.py:55
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/pcl_rl/expert_paths.py:39
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/delf/delf/python/training/model/global_model.py:143
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/delf/delf/python/training/global_features/train_utils.py:257
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/delf/delf/python/training/global_features/train_utils.py:244
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/delf/delf/python/datasets/tuples_dataset.py:74
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/delf/delf/python/datasets/sfm120k/sfm120k.py:96
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepresearch/delf/delf/python/datasets/revisited_op/dataset.py:515
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepofficial/recommendation/data_preprocessing.py:154
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Deploy/detr_cloud_deployment/client/big_query_ops.py:137
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Triton_TF_Cloud_Deployment/client/inference_pipeline.py:435
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Triton_TF_Cloud_Deployment/client/inference_pipeline.py:391
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Triton_TF_Cloud_Deployment/client/inference_pipeline.py:368
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Triton_TF_Cloud_Deployment/client/inference_pipeline.py:130
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Deploy/pet_grading_cloud_deployment/utils.py:110
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Deploy/pet_grading_cloud_deployment/big_query_ops.py:127
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/Deploy/detr_cloud_deployment/client/utils.py:104
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepresearch/efficient-hrl/scripts/local_train.py:72
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepresearch/efficient-hrl/scripts/local_eval.py:72
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/model_inference/download_and_unzip_models.py:58
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/docker_solution/prediction_pipeline/gsutil_ops.py:56
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepofficial/projects/waste_identification_ml/docker_solution/prediction_pipeline/gsutil_ops.py:33
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/android/Dockerfile:27
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/android/Dockerfile:71
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/android/Dockerfile:39
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/tf2_ai_platform/Dockerfile:6
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/tf2/Dockerfile:18
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/tf2/Dockerfile:6
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/tf1/Dockerfile:18
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivyresearch/object_detection/dockerfiles/tf1/Dockerfile:6
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivyofficial/projects/waste_identification_ml/llm_applications/milk_pouch_detection/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivyresearch/object_detection/dockerfiles/android/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivyresearch/object_detection/dockerfiles/tf2_ai_platform/Dockerfile:0
  • opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
    opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
    trivy
  • Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API
    Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed…
    trivyCVE-2026-59205
  • Pillow: Pillow: Denial of Service via crafted JPEG2000 image
    Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient …
    trivyCVE-2026-59204
  • Pillow: Pillow: Denial of service via crafted PDF stream
    Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaus…
    trivyCVE-2026-59200
  • Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing
    Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leadi…
    trivyCVE-2026-40192
  • Pillow: Pillow: Denial of Service via out-of-bounds write in image processing
    Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in v…
    trivyCVE-2026-59199
  • Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image
    Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.t…
    trivyCVE-2026-54058
  • Pillow: Pillow: Native heap out-of-bounds write
    Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size vali…
    trivyCVE-2026-59197
  • pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
    Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.
    trivyCVE-2026-25990
  • Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing
    Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
    trivyCVE-2026-42311
  • python-pillow: Pillow: Denial of Service via crafted BDF font file
    Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented de…
    trivyCVE-2026-55379
  • python-pillow: Pillow: Denial of Service via crafted GD 2.x image file
    Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap alloca…
    trivyCVE-2026-55380
  • python-pillow: Pillow: Denial of Service via crafted PCF font data
    Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause exce…
    trivyCVE-2026-54059
  • python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files
    Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during …
    trivyCVE-2026-54060

This report is public.