Threats tagged 'brew-mlx-lm-cve-2025-14927'

CVE-2025-14927 is a high-severity remote code execution vulnerability in Hugging Face Transformers version 4.57.0, specifically in the convert_config function. It arises from improper validation of user-supplied strings that are executed as Python code, enabling attackers to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically converting a malicious checkpoint file. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 7.8. There are no known exploits in the wild yet, but the risk is significant due to the widespread use of Hugging Face Transformers in AI and ML workflows. European organizations using this library in development or production environments are at risk, especially those in countries with strong AI sectors. Mitigation involves avoiding untrusted checkpoint files, applying patches once available, and implementing strict input validation and sandboxing.