MindSpore vulnerable to memory corruption
Published May 30, 2023 · Updated Oct 23, 2026 · Also known as GHSA-x67g-47p3-rc7f, PYSEC-2023-81
Original summary
Normalized public record · Updated Oct 23, 2026
MindSpore vulnerable to memory corruption
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function `JsonHelper::UpdateArray` of the file `mindspore/ccsrc/minddata/dataset/util/json_helper.cc`. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- GHSA-x67g-47p3-rc7f, PYSEC-2023-81
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
Record history
Published May 30, 2023 · Last refreshed Oct 23, 2026