Vulnerabilities for torchserve

First version without a known vulnerability: 0.11.1

Details

• GHSA-xx7c-j7h3-vjcq2025-03-20

  TorchServe script references S3 bucket without ensuring ownership or confirming accessibility

• GHSA-hhpg-v63p-wp7w2024-07-18

  TorchServe gRPC Port Exposure

  Fixed in: 0.11.0

• GHSA-wxcx-gg9c-fwp22024-07-18

  TorchServe vulnerable to bypass of allowed_urls configuration

  Fixed in: 0.11.0

• GHSA-m2mj-pr4f-h9jp2023-11-21

  TorchServe ZipSlip

  Fixed in: 0.9.0

• GHSA-8fxr-qfr9-p34w2023-10-02

  TorchServe Server-Side Request Forgery vulnerability

  Fixed in: 0.8.2

• GHSA-4mqg-h5jf-j9m72023-10-02

  TorchServe Pre-Auth Remote Code Execution

  Fixed in: 0.8.2