// posture advisories 100 provenance 75 resolution 80 xyz safety 100 load safety 100 supply chain 100 scanner trust 100 code execution 25 fig. 01 — posture on eight axes, 100 is clean. Weakest: code execution at 25. // the finding 0.0 xyz score out of 10 LOW
MEDIUM config.json declares `auto_map` — from_pretrained(trust_remote_code=True) executes Python shipped in this repo.
INFO authored against vulnerable: further detail on this finding is available to account holders.INFO inferred stack advisories: further detail on this finding is available to account holders.2 more findings on this model.
Author MiniMaxAI Task image-text-to-text Downloads 29,356 Remote code ships Python that runs on load (trust_remote_code) // dependencies 23 direct, 20 with findings, 99 reachable
Package Evidence Advisories Worst pillow direct, runtime 71 none pinned transformers direct, runtime 23 none pinned torch direct, install 13 hidden numpy direct, install 8 hidden flash-attn direct, install 1 hidden einops direct, install 0 hidden safetensors direct, install 0 hidden torchvision direct, install 0 hidden
Risk computed 2026-09-22 at 18:58 UTC. Dependencies come from the model's requirements, its declared loader and the code it ships; advisories from NVD, GHSA and OSV.
Model risk is computed from the model's declared and observed Python dependencies and the code it ships. If a finding is wrong, tell us. Report an issue with this page