// posture advisories 100 provenance 75 resolution 100 xyz safety 100 load safety 100 supply chain 100 scanner trust 100 code execution 25 fig. 01 — posture on eight axes, 100 is clean. Weakest: code execution at 25. // the finding 0.0 xyz score out of 10 LOW
MEDIUM config.json declares `auto_map` — from_pretrained(trust_remote_code=True) executes Python shipped in this repo.
INFO authored against vulnerable: further detail on this finding is available to account holders.INFO inferred stack advisories: further detail on this finding is available to account holders.2 more findings on this model.
Author deepseek-ai Task image-text-to-text Loader transformers License apache-2.0 Downloads 911,532 Remote code ships Python that runs on load (trust_remote_code) // dependencies 24 direct, 17 with findings, 114 reachable
Package Evidence Advisories Worst pillow direct, runtime 71 none pinned transformers direct, runtime 23 none pinned torch direct, install 13 hidden numpy direct, install 8 hidden requests direct, install 8 hidden tqdm direct, install 2 hidden flash-attn direct, install 1 hidden addict direct, install 0 hidden
Risk computed 2026-09-22 at 18:44 UTC. Dependencies come from the model's requirements, its declared loader and the code it ships; advisories from NVD, GHSA and OSV.
Model risk is computed from the model's declared and observed Python dependencies and the code it ships. If a finding is wrong, tell us. Report an issue with this page