--- title: "alpaca-lora trust report" type: "trust-report" slug: "tloen-alpaca-lora" canonical_url: "https://www.graphcanon.com/tools/tloen-alpaca-lora/trust" computed_at: "2026-07-11T23:21:55.583Z" maintenance_label: "Dormant" security_status: "findings" --- # alpaca-lora trust report _Sourced [trust signals](/glossary/trust-and-signals/trust-signal) from public GitHub metadata and optional dependency [security scans](/glossary/trust-and-signals/security-scan). Not a security guarantee._ ## Maintenance - Label: Dormant (18% recency signal) - Days since last push: 712 - Methodology: github_public_v1 ## Provenance - GitHub repo id: 613591358 - Not a fork - Owner type: User - Computed at: 2026-07-11T23:21:55.583Z - Methodology: github_public_v1 ## Security scan - Status: Findings present (1 critical, 5 high, 12 medium, 28 low) · last scan 2026-07-11T23:21:56.017Z ### Findings - **medium**: transformers has Insecure Temporary File (transformers@4.28.0 · CVE-2023-2800 · requirements.txt) - **high**: HuggingFace transformers vulnerable to remote code execution (transformers@4.28.0 · CVE-2026-4372 · requirements.txt) - **medium**: Transformers is vulnerable to ReDoS attack through its DonutProcessor class (transformers@4.28.0 · CVE-2025-3933 · requirements.txt) - **low**: Transformers Deserialization of Untrusted Data vulnerability (transformers@4.28.0 · CVE-2024-3568 · requirements.txt) - **critical**: transformers has a Deserialization of Untrusted Data vulnerability (transformers@4.28.0 · CVE-2023-6730 · requirements.txt) - **medium**: Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer (transformers@4.28.0 · CVE-2025-6921 · requirements.txt) - **medium**: Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer (transformers@4.28.0 · CVE-2025-6638 · requirements.txt) - **medium**: HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class (transformers@4.28.0 · CVE-2026-1839 · requirements.txt) - **medium**: Transformers Regular Expression Denial of Service (ReDoS) vulnerability (transformers@4.28.0 · CVE-2024-12720 · requirements.txt) - **medium**: Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability (transformers@4.28.0 · CVE-2025-5197 · requirements.txt) - **medium**: Transformers Regular Expression Denial of Service (ReDoS) vulnerability (transformers@4.28.0 · CVE-2025-1194 · requirements.txt) - **high**: Deserialization of Untrusted Data in Hugging Face Transformers (transformers@4.28.0 · CVE-2024-11394 · requirements.txt) - **medium**: Transformers vulnerable to ReDoS attack through its get_imports() function (transformers@4.28.0 · CVE-2025-3264 · requirements.txt) - **low**: Transformers's Improper Input Validation vulnerability can be exploited through username injection (transformers@4.28.0 · CVE-2025-3777 · requirements.txt) - **medium**: Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking (transformers@4.28.0 · CVE-2025-3263 · requirements.txt) - **medium**: Hugging Face Transformers Regular Expression Denial of Service (transformers@4.28.0 · CVE-2025-2099 · requirements.txt) - **high**: Deserialization of Untrusted Data in Hugging Face Transformers (transformers@4.28.0 · CVE-2024-11392 · requirements.txt) - **medium**: Hugging Face Transformers library has Regular Expression Denial of Service (transformers@4.28.0 · CVE-2025-6051 · requirements.txt) - **high**: transformers has a Deserialization of Untrusted Data vulnerability (transformers@4.28.0 · CVE-2023-7018 · requirements.txt) - **high**: Deserialization of Untrusted Data in Hugging Face Transformers (transformers@4.28.0 · CVE-2024-11393 · requirements.txt) - **low**: PYSEC-2023-299 (transformers@4.28.0 · CVE-2023-2800 · requirements.txt) - **low**: PYSEC-2023-300 (transformers@4.28.0 · CVE-2023-6730 · requirements.txt) - **low**: PYSEC-2023-301 (transformers@4.28.0 · CVE-2023-7018 · requirements.txt) - **low**: PYSEC-2024-227 (transformers@4.28.0 · CVE-2024-11392 · requirements.txt) - **low**: PYSEC-2024-228 (transformers@4.28.0 · CVE-2024-11393 · requirements.txt) - **low**: PYSEC-2024-229 (transformers@4.28.0 · CVE-2024-11394 · requirements.txt) - **low**: PYSEC-2025-211 (transformers@4.28.0 · CVE-2025-14920 · requirements.txt) - **low**: PYSEC-2025-212 (transformers@4.28.0 · CVE-2025-14921 · requirements.txt) - **low**: PYSEC-2025-213 (transformers@4.28.0 · CVE-2025-14924 · requirements.txt) - **low**: PYSEC-2025-214 (transformers@4.28.0 · CVE-2025-14926 · requirements.txt) - **low**: PYSEC-2025-215 (transformers@4.28.0 · CVE-2025-14927 · requirements.txt) - **low**: PYSEC-2025-216 (transformers@4.28.0 · CVE-2025-14928 · requirements.txt) - **low**: PYSEC-2025-217 (transformers@4.28.0 · CVE-2025-14929 · requirements.txt) - **low**: PYSEC-2025-218 (transformers@4.28.0 · CVE-2025-14930 · requirements.txt) - **low**: PYSEC-2025-40 (transformers@4.28.0 · CVE-2025-2099 · requirements.txt) - **low**: Transformers is vulnerable to ReDoS attack through its DonutProcessor class (transformers@4.28.0 · CVE-2025-3933 · requirements.txt) - **low**: Transformers Deserialization of Untrusted Data vulnerability (transformers@4.28.0 · CVE-2024-3568 · requirements.txt) - **low**: Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer (transformers@4.28.0 · CVE-2025-6921 · requirements.txt) - **low**: Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer (transformers@4.28.0 · CVE-2025-6638 · requirements.txt) - **low**: Transformers Regular Expression Denial of Service (ReDoS) vulnerability (transformers@4.28.0 · CVE-2024-12720 · requirements.txt) - **low**: Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability (transformers@4.28.0 · CVE-2025-5197 · requirements.txt) - **low**: Transformers Regular Expression Denial of Service (ReDoS) vulnerability (transformers@4.28.0 · CVE-2025-1194 · requirements.txt) - **low**: Transformers vulnerable to ReDoS attack through its get_imports() function (transformers@4.28.0 · CVE-2025-3264 · requirements.txt) - **low**: Transformers's Improper Input Validation vulnerability can be exploited through username injection (transformers@4.28.0 · CVE-2025-3777 · requirements.txt) - **low**: Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking (transformers@4.28.0 · CVE-2025-3263 · requirements.txt) - **low**: Hugging Face Transformers library has Regular Expression Denial of Service (transformers@4.28.0 · CVE-2025-6051 · requirements.txt) ## Method and caveats These are heuristics from public GitHub data and optional dependency scans, sourced and dated. "No criticals found on 2026-07-11" is not a guarantee of safety. See the full methodology: [/trust-methodology](/trust-methodology.md). ## Common questions ### Is alpaca-lora maintained? GraphCanon rates alpaca-lora "Dormant" (18% maintenance signal from public GitHub metadata, computed today). Last push was 712 days ago. This is a recency heuristic, not a guarantee the project will stay maintained. ### Is alpaca-lora safe to use? Last scanned today (deps profile). Status: 1 critical, 5 high, 12 medium, 28 low - 1 critical, 5 high, 12 medium, 28 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify alpaca-lora as safe - review maintenance, provenance, and scan findings on this page before adopting. ### Is alpaca-lora a fork? No. alpaca-lora is not flagged as a fork in GitHub metadata at the time of the last refresh. ### Does alpaca-lora have known security vulnerabilities? Last scanned today (deps profile). Status: 1 critical, 5 high, 12 medium, 28 low - 1 critical, 5 high, 12 medium, 28 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. ### How often is the alpaca-lora trust report updated? Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed today (methodology github_public_v1). ### What does GraphCanon never claim about alpaca-lora? We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for alpaca-lora. Signals are sourced heuristics with explicit limits - see [trust methodology](/trust-methodology). ### How does GraphCanon assess trust for alpaca-lora? Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read [trust methodology](/trust-methodology) for full scope and limits. --- **Machine-readable endpoints** - JSON: [`/api/graphcanon/tools/tloen-alpaca-lora/trust`](/api/graphcanon/tools/tloen-alpaca-lora/trust) - LLM index: [/llms.txt](/llms.txt) - Full corpus: [/llms-full.txt](/llms-full.txt) _GraphCanon - The knowledge graph for AI development. https://www.graphcanon.com/_