{"data":{"id":"ed11e34c-20c6-4787-9d2e-a7317a66864d","title":"CVE-2023-43654: TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks…","summary":"TorchServe's default configuration lacks proper input validation, so third parties can trigger remote HTTP download requests and write files to disk. The flaw affects versions 0.1.0 through 0.8.1 and could compromise system integrity and sensitive data.","solution":"Users are advised to upgrade to TorchServe 0.8.2, which includes a pull request (PR #2534) that warns when the default allowed_urls value is used. The source states there are no known workarounds.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-43654","publishedAt":"2023-09-29T03:15:09.627Z","cveId":"CVE-2023-43654","cweIds":["CWE-918"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["torchserve@>= 0.1.0, < 0.8.2 (fixed: 0.8.2)"],"affectedPackageNames":["torchserve"],"affectedPackageRefs":["pypi:torchserve"],"affectedVendors":[],"affectedVendorsRaw":["TorchServe","PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TorchServe lacks input validation enabling remote file writes","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.42495,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-8fxr-qfr9-p34w"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:46.073Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-08-28T19:29:41.036Z","daysToFix":-32,"fixCheckedAt":"2026-10-29T21:46:46.795Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"torchserve","fixedVersion":"0.8.2","matchedVersion":"0.8.2","fixReleasedAt":"2023-08-28T19:29:41.036Z","daysToFix":-32,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:46.645Z"}]}}