🔒 [IBM OSPO Security Notification] — IBM/materials

## 🔒 [IBM OSPO Security Notification] — IBM/materials

> **Action required:** Remediate the alerts listed below before their SLA deadline.
> This issue will be closed automatically once all alerts are resolved.
>
> **SLA policy:** critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
> Alerts at or above medium severity will trigger a warning comment before the deadline and
> repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
> they will never trigger warnings or archiving.
>
> 💡 **Tip:** To have Dependabot automatically open fix PRs for dependency alerts, enable
> **Dependabot security updates** in your repo settings:
> Settings → Advanced Security → Dependabot security updates → Enable.
>
> 📖 **New to this issue?** See the [Security Issue Guide](https://ibm.github.io/security-ops-bot/security-issue-guide.html#what-you-should-do) for a full explanation of what this issue means and what you need to do.

Attention: @davebraines @emiliobrazil @indra-ipd @neumannrf

### Dependabot Alerts

| Severity | CVE/GHSA | Package | Affected | Patched | Deadline | Fix PR |
|---|---|---|---|---|---|---|
| 🔴 critical | CVE-2025-32434 | torch | < 2.6.0 | 2.6.0 | 2026-10-07 | — |
| 🔴 critical | CVE-2024-8769 | aim | >= 3.15.0, <= 3.27.0 | — | 2026-10-07 | — |
| 🟠 high | CVE-2024-11392 | transformers | >= 0, < 4.48.0 | 4.48.0 | 2026-10-30 | — |
| 🟠 high | CVE-2024-11394 | transformers | >= 0, < 4.48.0 | 4.48.0 | 2026-10-30 | — |
| 🟠 high | CVE-2024-11393 | transformers | >= 0, < 4.48.0 | 4.48.0 | 2026-10-30 | — |
| 🟠 high | CVE-2024-31583 | torch | < 2.2.0 | 2.2.0 | 2026-10-30 | — |
| 🟠 high | CVE-2024-31580 | torch | < 2.2.0 | 2.2.0 | 2026-10-30 | — |
| 🟠 high | CVE-2026-40171 | notebook | >= 7.0.0, <= 7.5.5 | 7.5.6 | 2026-11-06 | — |
| 🟠 high | CVE-2026-42557 | notebook | >= 7.0.0, <= 7.5.5 | 7.5.6 | 2026-10-30 | — |
| 🟠 high | CVE-2026-4372 | transformers | < 5.3.0 | 5.3.0 | 2026-10-30 | — |
| 🟠 high | CVE-2026-5241 | transformers | < 5.5.0 | 5.5.0 | 2026-10-30 | — |
| 🟠 high | CVE-2026-68508 | hydra-core | <= 1.3.3 | 1.3.4 | 2026-10-30 | — |
| 🟠 high | CVE-2026-9856 | transformers | < 5.10.0 | 5.10.0 | 2026-10-30 | — |
| 🟡 medium | CVE-2024-12720 | transformers | < 4.48.0 | 4.48.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-1194 | transformers | < 4.50.0 | 4.50.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-2099 | transformers | < 4.50.0 | 4.50.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-3730 | torch | <= 2.7.1 | 2.8.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-3263 | transformers | < 4.51.0 | 4.51.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-3264 | transformers | < 4.51.0 | 4.51.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-3933 | transformers | <= 4.51.3 | 4.52.1 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-5197 | transformers | < 4.53.0 | 4.53.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-51464 | aim | <= 3.30.0.dev20250611 | — | 2026-12-29 | — |
| 🟡 medium | CVE-2025-6638 | transformers | < 4.53.0 | 4.53.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-6051 | transformers | < 4.53.0 | 4.53.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2025-6921 | transformers | < 4.53.0 | 4.53.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2026-1839 | transformers | < 5.0.0rc3 | 5.0.0rc3 | 2027-01-05 | — |
| 🟡 medium | CVE-2025-2998 | torch | <= 2.6.0 | — | 2026-12-29 | — |
| 🟡 medium | CVE-2025-2999 | torch | < 2.9.1 | 2.9.1 | 2026-12-29 | — |
| 🟡 medium | CVE-2026-59890 | setuptools | < 83.0.0 | 83.0.0 | 2026-12-29 | — |
| 🟡 medium | CVE-2026-69112 | accelerate | <= 1.14.0 | — | 2026-12-29 | — |

### Code Scanning Alerts

| Severity | Rule | Tool | Deadline |
|---|---|---|---|
| 🟠 high | py/code-injection | CodeQL | 2026-10-29 |
| 🟠 high | py/path-injection | CodeQL | 2026-10-29 |
| 🟠 high | py/path-injection | CodeQL | 2026-10-29 |
| 🟠 high | py/path-injection | CodeQL | 2026-10-29 |
| 🟠 high | py/path-injection | CodeQL | 2026-10-29 |
| 🟠 high | py/path-injection | CodeQL | 2026-10-29 |
| 🟠 high | py/path-injection | CodeQL | 2026-10-29 |
| 🟡 medium | actions/missing-workflow-permissions | CodeQL | 2026-12-28 |
| 🟡 medium | actions/missing-workflow-permissions | CodeQL | 2026-12-28 |


### Secret Scanning Alerts

_No open secret scanning alerts._

---

Navigation Menu

Repository navigation

🔒 [IBM OSPO Security Notification] — IBM/materials #73