PyPI: tensorflow

CVE-2022-23563

Safety vulnerability ID: SFTY-20220204-32018

Safety legacy ID: pyup.io-44851

Tensorflow versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-23563: In multiple places, TensorFlow uses 'tempfile.mktemp' to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in 'mktemp' and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness). In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the 'mktemp' function usage. It was replaced 'mktemp' with the safer 'mkstemp'/'mkdtemp' functions, according to the usage pattern. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wc4g-r73w-x8mm

PythonPyPINVDNVDGitHubGHSA
Created at: Jul 5, 2026Updated at: Jul 5, 2026

Overview

Insecure temporary file in Tensorflow

Advisory

Tensorflow versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-23563: In multiple places, TensorFlow uses 'tempfile.mktemp' to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in 'mktemp' and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness). In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the 'mktemp' function usage. It was replaced 'mktemp' with the safer 'mkstemp'/'mkdtemp' functions, according to the usage pattern. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wc4g-r73w-x8mm

Affected Package

Affecting tensorflow package, versions<2.5.3>=2.6.0a0,<2.6.3>=2.7.0a0,<2.7.1>=2.8.0a0,<2.8.0

Also affects

---

How to Fix

Upgradetensorflowto2.5.32.6.32.7.12.8.0or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more