Threat Intelligence Database

A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where keys from the `chat_template` dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Face Hub repository with a crafted `tokenizer_config.json` file. When a victim downloads and saves the tokenizer or processor, the attacker-controlled keys can escape the intended save directory, enabling arbitrary file writes with attacker-controlled content. This vulnerability affects multiple processors inheriting from `ProcessorMixin`, including Idefics, Florence, Gemma, Phi, and Qwen-VL.

CVE-2026-75104 is a path traversal vulnerability in the Hugging Face Transformers library. It arises because shard filenames in checkpoint index files are not properly validated, allowing crafted index files with directory traversal sequences or absolute paths. This can enable unauthorized reading of arbitrary files outside the intended model directory. The vulnerability affects all versions of the transformers library and has a CVSS score of 6.8, indicating medium severity.

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.

A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.

Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of weights. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28309.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-14930#cwe-502

Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint. The specific flaw exists within the convert_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28253.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-14928#cwe-94

CVE-2025-14927 is a high-severity remote code execution vulnerability in Hugging Face Transformers version 4.57.0, specifically in the convert_config function. It arises from improper validation of user-supplied strings that are executed as Python code, enabling attackers to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically converting a malicious checkpoint file. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. There are no known exploits in the wild yet, but the risk is significant due to the widespread use of Hugging Face Transformers in AI and ML workflows. European organizations using this library in development or production environments are at risk, especially those in countries with strong AI sectors. Mitigation involves avoiding untrusted checkpoint files, applying patches once available, and implementing strict input validation and sandboxing.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-14927#cwe-94

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `LightGlueConfig` reads the `trust_remote_code` value from the untrusted `config.json` file and propagates it into nested `AutoConfig.from_pretrained()` calls. This results in the execution of attacker-provided Python modules, even when the victim explicitly disables remote code execution. The vulnerability poses a high risk for environments such as API inference servers, research notebooks, CI/CD pipelines, and model evaluation workers, potentially leading to credential theft, lateral movement, or persistence/backdoor deployment.

CVE-2025-14926 is a high-severity code injection vulnerability in Hugging Face Transformers version 4.57.0, specifically in the convert_config function. It allows remote attackers to execute arbitrary Python code by supplying a malicious checkpoint configuration. Exploitation requires user interaction, as the target must convert a crafted checkpoint file. The vulnerability arises from improper validation of user-supplied strings before execution, enabling code execution with the privileges of the current user. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. This vulnerability poses a significant risk to organizations using Hugging Face Transformers for machine learning model management or deployment. European organizations relying on this library, especially in AI research and development sectors, should prioritize patching or mitigating this issue. Countries with strong AI and tech industries, such as Germany, France, the UK, and the Netherlands, are likely to be most affected.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-14926#cwe-94

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-3933#cwe-1333