This vulnerability (CVE-2026-4372) affects all versions of the HuggingFace transformers library before 5.3.0. It arises from missing serialization control elements (CWE-1066) that allow an attacker to embed a malicious `_attn_implementation_internal` field in a model's config.json. When a victim loads the model using AutoModelForCausalLM.from_pretrained(), the library downloads and executes attacker-controlled Python code from a specified HuggingFace Hub repository with the victim's OS privileges. The flaw bypasses the trust_remote_code security mechanism due to unfiltered deserialization and unsandboxed code execution, making exploitation stealthy and severe. The vulnerability has a CVSS 3.0 score of 7.8 (high severity).

Successful exploitation results in remote code execution on the victim's system with full operating system privileges. This can lead to complete system compromise, data theft, or further malicious activity. The attack is stealthy and exploits normal documented usage patterns, increasing risk to users of affected versions.

Users should upgrade to HuggingFace transformers version 5.3.0 or later, where this vulnerability is fixed. No official patch link was provided, but the vendor advisory clearly states upgrading to 5.3.0+ mitigates the issue. Until upgrading, avoid loading untrusted models or config files. Patch status is confirmed by the vendor advisory recommending version 5.3.0 or later.