pypi package report

Is tensorflow safe?

130 known vulnerabilities, worst severity HIGH.

// reach

33 direct dependencies

6 carry known advisories, worst CRITICAL

138 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai models

4 published models carry an advisory from this package

0 pin a version the advisory is confirmed against; the rest declare it without a version.

Synaptics/MobileNetV2CRITICALnot pinned
allenai/Molmo-7B-D-0924CRITICALnot pinned

4 published models

0 declared · 3 observed · 1 inferred

ModelEvidence
allenai/Molmo-7B-D-0924observed
jinaai/jina-reranker-v1-tiny-enobserved
Create a free accountto see all 2 models and per-model risk

4 published AI models are associated with this package: 0 name it in a requirements or pyproject file, 3 load it or import it directly, and 1 are inferred from the runtime stack their declared library pulls in. Only 0 state a version requirement, so this is not a count of affected models.

cvss
6.5
medium

CVSS v3.1 base score out of 10; GitHub rates it HIGH

epss
0.79%
medium

chance of exploitation in 30 days, 56th percentile of all CVEs

xyz score
4.5
medium

CyberXYZ composite out of 10

fig. 01 — GHSA-c94w-c95p-phf8, the advisory selected below

// 130 advisories

GHSA-c94w-c95p-phf8

HIGHGitHub ratingCVE-2022-23575
// impact

The implementation of OpLevelCostEstimator::CalculateTensorSize is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements:

int64_t OpLevelCostEstimator::CalculateTensorSize(
    const OpInfo::TensorProperties& tensor, bool* found_unknown_shapes) {
  int64_t count = CalculateTensorElementCount(tensor, found_unknown_shapes);
  int size = DataTypeSize(BaseType(tensor.dtype()));
  VLOG(2) << "Count: " << count << " DataTypeSize: " << size;
  return count * size;
}

Here, count and size can be large enough to cause count * size to overflow.

// patches

We have patched the issue in GitHub commit fcd18ce3101f245b083b30655c27b239dc72221e.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

// for more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Checked 2026-11-07 at 13:46 UTC. The most recent advisory here was published 2022-11-21. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.