Transformers vulnerabilities

12 known vulnerabilities in Transformers from Hugging Face. 12 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Transformers: Improper Check for Dropped Privileges

  CVE-2026-80047Sep 1, 2026Hugging Face

  A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module fi

• 7.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2025-14930Dec 23, 2025Hugging Face

  Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to e

• 7.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2025-14929Dec 23, 2025Hugging Face

  Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User inte

• 7.8 High severity

  Transformers: Improper Control of Generation of Code

  CVE-2025-14928Dec 23, 2025Hugging Face

  Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exp

• 7.8 High severity

  Transformers: Improper Control of Generation of Code

  CVE-2025-14927Dec 23, 2025Hugging Face

  Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to expl

• 7.8 High severity

  Transformers: Improper Control of Generation of Code

  CVE-2025-14926Dec 23, 2025Hugging Face

  Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploi

• 7.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2025-14924Dec 23, 2025Hugging Face

  Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is requ

• 7.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2025-14921Dec 23, 2025Hugging Face

  Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction

• 7.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2025-14920Dec 23, 2025Hugging Face

  Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is re

• 8.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2024-11394Nov 22, 2024Hugging FaceEPSS 2.73%

  Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is require

• 8.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2024-11393Nov 22, 2024Hugging FaceEPSS 3.27%

  Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is r

• 8.8 High severity

  Transformers: Deserialization of Untrusted Data

  CVE-2024-11392Nov 22, 2024Hugging FaceEPSS 7.72%

  Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is requir