Hoch

HuggingFace transformers vulnerable to remote code execution

Veröffentlicht: 24.05.2026
Aktualisiert: 11.10.2026 15:17

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard AutoModelForCausalLM.from_pretrained() API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the trust_remote_code security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Python (PyPI)	transformers	< 5.3.0	5.3.0

Verweise

CVSS-Wert 7.8/10

CVSS-Vektor: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Schwäche (CWE): CWE-1066, CWE-502
Plattform: Python (PyPI)
Paket: transformers
Veröffentlicht: 24.05.2026
Aktualisiert: 11.10.2026 15:17

Quellen und Lizenzen

OSV / GitHub Advisory Database - PYSEC-2026-2289 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-29pf-2h5f-8g72 - CC BY 4.0

Schwachstellenhistorie: transformers

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (32) im Archiv

Einträge insgesamt: 32
Erste → letzte: 05.2023 09.2026
Ohne Fix: 9
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Hoch 18
Mittel 12
Niedrig 2

Veröffentlichungen pro Jahr

2023: 3
2024: 4
2025: 20
2026: 5

01.09.2026

Hugging Face Transformers downloads custom generation code before trust consent

Hoch · 7.8 CVE-2026-80047 >= 4.49.0, <= 5.8.1 keine Korrektur
02.08.2026

Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

Hoch · 7.1 CVE-2026-9856 < 5.10.0 5.10.0
03.06.2026

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

Hoch · 8.0 CVE-2026-5241 < 5.5.0 5.5.0
24.05.2026

HuggingFace transformers vulnerable to remote code execution dieser Eintrag

Hoch · 7.8 CVE-2026-4372 < 5.3.0 5.3.0
23.12.2025

Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of

Hoch · 7.8 CVE-2025-14930 <= 4.57.1 keine Korrektur
23.12.2025

Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hu

Hoch · 7.8 CVE-2025-14928 <= 4.57.0 keine Korrektur
23.12.2025

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af

Hoch · 7.8 CVE-2025-14929 <= 5.0.0-rc0 keine Korrektur
23.12.2025

Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Huggi

Hoch · 7.8 CVE-2025-14926 <= 4.57.0 keine Korrektur
23.12.2025

Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hug

Hoch · 7.8 CVE-2025-14927 <= 4.57.0 keine Korrektur
23.12.2025

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected instal

Hoch · 7.8 CVE-2025-14920 <= 4.54.1 keine Korrektur
23.12.2025

Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i

Hoch · 7.8 CVE-2025-14921 <= 4.54.1 keine Korrektur
23.12.2025

Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa

Hoch · 7.8 CVE-2025-14924 <= 4.55.0 keine Korrektur
19.05.2025

A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) a

Hoch · 7.5 CVE-2025-2099 < 4.49.0 4.49.0
22.11.2024

Deserialization of Untrusted Data in Hugging Face Transformers

Hoch · 8.8 CVE-2024-11394 < 4.48.0 4.48.0
22.11.2024

Deserialization of Untrusted Data in Hugging Face Transformers

Hoch · 8.8 CVE-2024-11393 < 4.48.0 4.48.0
22.11.2024

Deserialization of Untrusted Data in Hugging Face Transformers

Hoch · 7.5 CVE-2024-11392 < 4.48.0 4.48.0
20.12.2023

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Hoch · 7.8 CVE-2023-7018 < 4.36.0 4.36.0
19.12.2023

Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.

Hoch · 8.8 CVE-2023-6730 < 4.36.0 4.36.0

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden