CVE-2025-14929 is a high-severity vulnerability in Hugging Face Transformers affecting the X-CLIP checkpoint conversion process. It arises from improper validation of user-supplied data during deserialization, enabling remote code execution if a user opens a malicious file or visits a crafted webpage. Exploitation requires user interaction but no prior authentication. The vulnerability impacts confidentiality, integrity, and availability by allowing arbitrary code execution within the affected process context. No known exploits are currently in the wild. European organizations using vulnerable versions of Hugging Face Transformers, especially in AI/ML workflows, face significant risk. Mitigation involves avoiding untrusted checkpoint files, applying patches when available, and implementing strict input validation and sandboxing. Countries with strong AI sectors and extensive use of Hugging Face tools, such as Germany, France, the UK, and the Netherlands, are most likely affected.
