VEX: draft status for untriaged findings

Nobody has claimed this yet.

## Summary

Drafts VEX statements for three untriaged `transformers@4.57.6` vulnerabilities detected in `scripts/evals/moderation/uv.lock` and reported in #2283. All three are present because the `transformers <5` constraint in `pyproject.toml` blocks upgrading to any of the fixed releases (5.0.0rc3, 5.0.0rc3, and 5.3.0 respectively).

| CVE | Aliases | Drafted Status | Confidence |
|-----|---------|----------------|------------|
| CVE-2026-1839 | GHSA-69w3-r845-3855 | `not_affected` | High |
| CVE-2025-14929 | PYSEC-2025-217 | `not_affected` | High |
| CVE-2026-4372 | GHSA-29pf-2h5f-8g72 | `under_investigation` | Medium |

**Document mutation:** version 2 → 3, `last_updated` set to 2026-07-03T15:14:19Z, `@id` regenerated.

> This is an AI-assisted draft. Every status determination — especially `not_affected` — must be independently validated by a CODEOWNERS-required human reviewer before merging. The merge commit author is the accountable author of record.

---

## Evidence Checklist

* [x] Code citations provided (file path and line range for reachability evidence per CVE)
* [x] Vulnerability details included (CVE ID, advisory URL, CVSS score per CVE)
* [x] Reachability analysis completed (import path traced, dead code confirmed, or mitigation identified)
* [x] Licensing compliance verified (data sourced from CC0/public domain sources; GHSA prose not quoted)
* [ ] Reviewed and validated by a qualified human reviewer

---

## CVE Assessments

### CVE-2026-1839

**Advisory:** https://github.com/advisories/GHSA-69w3-r845-3855
**CVSS:** 6.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H) · CWE-502
**Fixed in:** transformers 5.0.0rc3

**VEX Status:**

* [x] `not_affected`

**Confidence Band:**

* [x] High: not_affected (vulnerable symbol provably unreachable)

**Impact Statement:**

The vulnerable symbol is `Trainer._load_rng_state()` (`src/transformers/trainer.py:3059`), which calls `torch.load()` without `weights_only=True`. This method belongs to the model-training API and is only invoked when fine-tuning or retraining a model from a checkpoint. The hve-core moderation eval (`scripts/evals/moderation/moderate.py`) is an inference-only pipeline: it imports only `from detoxify import Detoxify` (line 113) and calls `model.predict(text)` (line 126). No `Trainer` instantiation or checkpoint loading occurs anywhere in the pipeline or its test suite (`tests/test_moderate.py`). The attack path — supplying a malicious `rng_state.pth` checkpoint — cannot be triggered from this component. This assessment is also recorded in `scripts/evals/moderation/pip-audit-known-vulnerabilities.txt`.

---

### CVE-2025-14929

**Advisory:** (www.zerodayinitiative.com/redacted)
**CVSS:** 7.8 (reported by scanner) · PYSEC-2025-217
**Last affected:** transformers 5.0.0-rc0

**VEX Status:**

* [x] `not_affected`

**Confidence Band:**

* [x] High: not_affected (vulnerable symbol provably unreachable)

**Impact Statement:**

The vulnerability is in the X-CLIP checkpoint conversion utility (`src/transformers/models/xclip/`), a data-engineering tool for converting X-CLIP video-language model checkpoints. X-CLIP has no relationship to toxicity classification. The hve-core moderation eval loads BERT/ALBERT-based Detoxify models; model names are statically constrained to `['original', 'unbiased', 'multilingual']` by `argparse.choices` (`moderate.py` lines 49–53). No X-CLIP code, no checkpoint conversion, and no attacker-controlled model path are reachable from `moderate.py`. This assessment is also recorded in `scripts/evals/moderation/pip-audit-known-vulnerabilities.txt`.

---

### CVE-2026-4372

**Advisory:** https://github.com/advisories/GHSA-29pf-2h5f-8g72
**CVSS:** 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) · CWE-502, CWE-1066
**Fixed in:** transformers 5.3.0

**VEX Status:**

* [x] `under_investigation`

**Confidence Band:**

* [x] Medium (symbol reachable in some configurations but ambiguous)

**Impact Statement:**

The advisory describes RCE triggered when `AutoModelForCausalLM.from_pretrained()` deserializes a `config.json` containing `_attn_implementation_internal` set to an attacker-controlled HuggingFace Hub repository ID, causing arbitrary Python code to be downloaded and executed. The hve-core moderation eval uses only BERT/ALBERT classification models via detoxify; model names are constrained to `['original', 'unbiased', 'multilingual']` by `argparse.choices`, preventing attacker-controlled model path injection at the CLI. The CVSS attack vector is local (AV:L), requiring physical access or filesystem write capability.

**Reviewer question:** Does `BertForSequenceClassification.from_pretrained()` in transformers 4.57.6 process the `_attn_implementation_internal` config key through the same deserialization path as `AutoModelForCausalLM`? Inspect `src/transformers/configuration_utils.py` and `src/transformers/models/bert/configuration_bert.py` in the 4.57.6 release tree. If BERT configs do not process this field, update status to `not_affected` with justification `vulnerable_code_not_in_execute_path`.

---

## Additional Context

- Detection issue: #2283
- Source lock file: `scripts/evals/moderation/uv.lock`
- Existing pip-audit notes: `scripts/evals/moderation/pip-audit-known-vulnerabilities.txt`
- Updated VEX document: `security/vex/hve-core.openvex.json` (version 3)

> Generated by [VEX Drafting](https://github.com/microsoft/hve-core/actions/runs/28669081853) · 90.8 AIC · ⌖ 25.4 AIC · ⊞ 9.3K · [◷](https://github.com/search?q=repo%3Amicrosoft%2Fhve-core+%22gh-aw-workflow-id%3A+vex-draft%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
> The changes have been pushed to branch `vex/draft-untriaged-findings-2026-07-03-d1eb0c8ad4a0d11a`.
>
> **[Click here to create the pull request](https://github.com/microsoft/hve-core/compare/main...vex/draft-untriaged-findings-2026-07-03-d1eb0c8ad4a0d11a?expand=1&title=VEX%3A%20draft%20status%20for%20untriaged%20findings)**

To fix the permissions issue, go to **Settings** → **Actions** → **General** and enable **Allow GitHub Actions to create and approve pull requests**. See also: [gh-aw FAQ](https://github.github.com/gh-aw/reference/faq/#why-is-my-create-pull-request-workflow-failing-with-github-actions-is-not-permitted-to-create-or-approve-pull-requests)

Show patch preview (109 of 109 lines)

```diff
From b2d7c675987f13342bd4fd1c3ba5eeffd82806a0 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Fri, 3 Jul 2026 15:19:29 +0000
Subject: [PATCH] security(vex): draft VEX status for untriaged transformers
findings (issue #2283)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Draft VEX statements for three untriaged transformers@4.57.6 vulnerabilities
detected in scripts/evals/moderation/uv.lock.

- CVE-2026-1839 (GHSA-69w3-r845-3855): not_affected
Trainer._load_rng_state() is never invoked; moderation eval is inference-only.
- CVE-2025-14929 (PYSEC-2025-217): not_affected
X-CLIP checkpoint conversion is unreachable; detoxify uses BERT/ALBERT models only.
- CVE-2026-4372 (GHSA-29pf-2h5f-8g72): under_investigation
AutoModelForCausalLM config deserialization; pending confirmation that BERT
configs in 4.57.6 do not process _attn_implementation_internal.

Document: version 2 → 3, last_updated 2026-07-03T15:14:19Z.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
security/vex/hve-core.openvex.json | 67 ++++++++++++++++++++++++++++--
1 file changed, 64 insertions(+), 3 deletions(-)

diff --git a/security/vex/hve-core.openvex.json b/security/vex/hve-core.openvex.json
index 60dfd4c..7f13c4a 100644
--- a/security/vex/hve-core.openvex.json
+++ b/security/vex/hve-core.openvex.json
@@ -1,9 +1,70 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
- "@id": "https://github.com/microsoft/hve-core/security/vex/2026-06-19",
+ "@id": "https://github.com/microsoft/hve-core/security/vex/2026-07-03",
"author": "Microsoft HVE Core Maintainers",
"timestamp": "2026-06-19T00:00:00Z",
- "version": 2,
+ "last_updated": "2026-07-03T15:14:19Z",
+ "version": 3,
"tooling": "Maintained via the hve-core VEX Generator agent (AI-assisted drafting) with human review and merge; published and Sigstore-attested by the release-stable.yml workflow.",
- "statem
... (truncated)
```

Start with security/vex/hve-core.openvex.json and the moderation entry points in scripts/evals/moderation/moderate.py and tests/test_moderate.py. Inspect transformers 4.57.6 in configuration_utils.py and models/bert/configuration_bert.py to answer whether BERT processes _attn_implementation_internal. Done means independently validating all three statuses, resolving the reviewer question, and updating the VEX document with qualified human review.

Written by the indexing model from the issue text.