From e058a0723d139543810bc7288ca337ce1c11a02e Mon Sep 17 00:00:00 2001
From: Sai Teja Erukude <72928639+SaiTeja-Erukude@users.noreply.github.com>
Date: Sat, 15 Aug 2026 15:50:46 -0500
Subject: [PATCH] Improve GHSA-m3v4-v5gx-7wf5

---
 .../2026/06/GHSA-m3v4-v5gx-7wf5/GHSA-m3v4-v5gx-7wf5.json    | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/advisories/github-reviewed/2026/06/GHSA-m3v4-v5gx-7wf5/GHSA-m3v4-v5gx-7wf5.json b/advisories/github-reviewed/2026/06/GHSA-m3v4-v5gx-7wf5/GHSA-m3v4-v5gx-7wf5.json
index 766c2d01aa3a..d62d72e58f2d 100644
--- a/advisories/github-reviewed/2026/06/GHSA-m3v4-v5gx-7wf5/GHSA-m3v4-v5gx-7wf5.json
+++ b/advisories/github-reviewed/2026/06/GHSA-m3v4-v5gx-7wf5/GHSA-m3v4-v5gx-7wf5.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m3v4-v5gx-7wf5",
-  "modified": "2026-06-30T21:42:32Z",
+  "modified": "2026-06-30T21:42:34Z",
   "published": "2026-06-02T18:31:33Z",
   "aliases": [
     "CVE-2026-47117"
@@ -9,10 +9,6 @@
   "summary": "OpenMed vulnerable to remote code injection through privacy-filter model loading path",
   "details": "OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The privacy-filter dispatcher used broad substring matching on the user-supplied `model_name` parameter, allowing a value such as `attacker/foo-privacy-filter-bar` to route through a path that loads Hugging Face models with `trust_remote_code=True`. An unauthenticated attacker can supply a malicious model repository containing custom Transformers code via auto_map in `config.json` or `tokenizer_config.json`, which is imported and executed with the privileges of the OpenMed service process.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
-    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"