Update dependency transformers to v5#44
Security Report
❗️Scan Warnings: The scan completed with warnings. The integration encountered issues with one or more projects in this repository. Consequently, there may be gaps in the coverage of open-source dependencies used in the repository.
Scan Details Report
pip
/tmp/ws-scm/stable-diffusion-webui/requirements.txt
| Step | Level | Description | Details |
|---|---|---|---|
| Resolving the project | ⚠Warn | Issue parsing of one or more of the files | Failed to resolve the following dependencies: [tomli-2.4.1] from /tmp/ws-scm/stable-diffusion-webui/requirements.txt file. |
You have successfully remediated 60 vulnerabilities, but introduced 16 new vulnerabilities in this branch.❌ New vulnerabilities:
| Vulnerability | Severity |  CVSS Score |
Vulnerable Library | Direct Library | Suggested Fix | Issue | Reachability |
|---|---|---|---|---|---|---|---|
CVE-2026-0994Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/protobuf-3.20.0.dist-info Dependency Hierarchy: -> ❌ protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library) |
 High |
8.6 | Direct protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl |
protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl | protobuf - 6.33.5,https://github.com/protocolbuffers/protobuf.git - v33.5,https://github.com/protocolbuffers/protobuf.git - v29.6,https://github.com/protocolbuffers/protobuf.git - v3.29.6-objectivec,https://github.com/protocolbuffers/protobuf.git - v5.29.6-cpp,https://github.com/protocolbuffers/protobuf.git - v5.35.0-objectivec,https://github.com/protocolbuffers/protobuf.git - v4.33.5-objectivec | None | |
CVE-2026-42311Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> scikit_image-0.25.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
scikit_image-0.25.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Transitive 12.2.0 |
None | |
CVE-2026-42311Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> clean_fid-0.1.35-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
clean_fid-0.1.35-py3-none-any.whl | Transitive 12.2.0 |
#20 | |
CVE-2026-42311Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> gradio-3.41.2-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
gradio-3.41.2-py3-none-any.whl | Transitive 12.2.0 |
#2 | |
CVE-2026-42311Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> facexlib-0.3.0-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
facexlib-0.3.0-py3-none-any.whl | Transitive 12.2.0 |
#19 | |
CVE-2026-25990Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> scikit_image-0.25.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
scikit_image-0.25.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Transitive 12.1.1 |
None | |
CVE-2026-25990Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> clean_fid-0.1.35-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
clean_fid-0.1.35-py3-none-any.whl | Transitive 12.1.1 |
#20 | |
CVE-2026-25990Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> gradio-3.41.2-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
gradio-3.41.2-py3-none-any.whl | Transitive 12.1.1 |
#2 | |
CVE-2026-25990Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> facexlib-0.3.0-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
8.4 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
facexlib-0.3.0-py3-none-any.whl | Transitive 12.1.1 |
#19 | |
CVE-2025-14920Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/transformers-5.5.0.dist-info Dependency Hierarchy: -> ❌ transformers-5.5.0-py3-none-any.whl (Vulnerable Library) |
High |
7.8 | Direct transformers-5.5.0-py3-none-any.whl |
transformers-5.5.0-py3-none-any.whl | None | ||
CVE-2026-40192Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> scikit_image-0.25.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
7.5 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
scikit_image-0.25.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Transitive https://github.com/python-pillow/Pillow.git - 12.2.0 |
None | |
CVE-2026-40192Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> clean_fid-0.1.35-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
7.5 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
clean_fid-0.1.35-py3-none-any.whl | Transitive https://github.com/python-pillow/Pillow.git - 12.2.0 |
#20 | |
CVE-2026-40192Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> gradio-3.41.2-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
7.5 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
gradio-3.41.2-py3-none-any.whl | Transitive https://github.com/python-pillow/Pillow.git - 12.2.0 |
#2 | |
CVE-2026-40192Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/pillow-10.4.0.dist-info Dependency Hierarchy: -> facexlib-0.3.0-py3-none-any.whl (Root Library) -> ❌ pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl (Vulnerable Library) |
High |
7.5 | Transitive pillow-10.4.0-cp310-cp310-manylinux_2_28_x86_64.whl |
facexlib-0.3.0-py3-none-any.whl | Transitive https://github.com/python-pillow/Pillow.git - 12.2.0 |
#19 | |
CVE-2025-4565Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/protobuf-3.20.0.dist-info Dependency Hierarchy: -> ❌ protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library) |
High |
7.5 | Direct protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl |
protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl | 4.25.8 | None | |
CVE-2022-1941Path to dependency file: /requirements.txt Path to vulnerable library: /tmp/ws-ua_20260604184730_IJQFOB/python_SMPHQX/202606041847311/env/lib/python3.10/site-packages/protobuf-3.20.0.dist-info Dependency Hierarchy: -> ❌ protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl (Vulnerable Library) |
High |
7.5 | Direct protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl |
protobuf-3.20.0-cp310-cp310-manylinux_2_12_x86_64.manylinux2010_x86_64.whl | 3.20.2 | None |
✔️ Remediated vulnerabilities:
| Vulnerability | Vulnerable Library |
|---|---|
| CVE-2026-44243 | gitpython-3.1.46-py3-none-any.whl |
| CVE-2025-3263 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-14929 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-68146 | filelock-3.19.1-py3-none-any.whl |
| CVE-2025-14925 | accelerate-1.10.1-py3-none-any.whl |
| CVE-2026-42561 | python_multipart-0.0.20-py3-none-any.whl |
| CVE-2025-14926 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-48710 | starlette-0.49.3-py3-none-any.whl |
| CVE-2026-42311 | pillow-10.4.0-cp39-cp39-manylinux_2_28_x86_64.whl |
| CVE-2026-45409 | idna-3.11-py3-none-any.whl |
| CVE-2024-11394 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-3777 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-44431 | urllib3-2.6.3-py3-none-any.whl |
| CVE-2026-31221 | pytorch_lightning-2.6.0-py3-none-any.whl |
| CVE-2026-25645 | requests-2.32.5-py3-none-any.whl |
| CVE-2024-11393 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-6051 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-3264 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-1839 | transformers-4.30.2-py3-none-any.whl |
| CVE-2023-7018 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-42284 | gitpython-3.1.46-py3-none-any.whl |
| CVE-2025-6921 | transformers-4.30.2-py3-none-any.whl |
| CVE-2024-3568 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-5241 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-2099 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-67221 | orjson-3.11.5-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| CVE-2025-2998 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2025-55551 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2025-2999 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2025-5197 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-6638 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-14924 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-3933 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-55552 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2025-4565 | protobuf-3.20.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl |
| CVE-2024-11392 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-7246 | click-8.1.8-py3-none-any.whl |
| CVE-2026-44432 | urllib3-2.6.3-py3-none-any.whl |
| CVE-2025-1194 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-4372 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-22701 | filelock-3.19.1-py3-none-any.whl |
| CVE-2025-14927 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-14921 | transformers-4.30.2-py3-none-any.whl |
| CVE-2024-12720 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-63396 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2026-24486 | python_multipart-0.0.20-py3-none-any.whl |
| CVE-2026-4538 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2026-40192 | pillow-10.4.0-cp39-cp39-manylinux_2_28_x86_64.whl |
| CVE-2025-14928 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-14920 | transformers-4.30.2-py3-none-any.whl |
| CVE-2025-3262 | transformers-4.30.2-py3-none-any.whl |
| CVE-2022-1941 | protobuf-3.20.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl |
| CVE-2023-6730 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-40347 | python_multipart-0.0.20-py3-none-any.whl |
| CVE-2026-24747 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2025-3001 | torch-2.8.0-cp310-none-macosx_11_0_arm64.whl |
| CVE-2026-44244 | gitpython-3.1.46-py3-none-any.whl |
| CVE-2026-25990 | pillow-10.4.0-cp39-cp39-manylinux_2_28_x86_64.whl |
| CVE-2025-14930 | transformers-4.30.2-py3-none-any.whl |
| CVE-2026-0994 | protobuf-3.20.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl |
Base branch total remaining vulnerabilities: 98
Base branch commit: c5914a21ae954deee909aaaafbb8ad722da7ffa9
Total libraries scanned: 142
Scan token: 89319456b3424321a92a989b0e494f80