Transformers — CVE history (PyPI)
Transformers
32 CVEs affect the Transformers PyPI package (highest CVSS 9.6). Latest disclosed: 2026-09-01. Full CVE history sourced from NVD.
Summary
- Package
Transformers(PyPI)- Total CVEs
32- Actively exploited (CISA KEV)
- 0
- Highest CVSS
9.6- Latest disclosed
- 2026-09-01
Recent CVEs (top 20)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-80047 | High | 7.8 | — | 2026-09-01 | A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). |
CVE-2026-75104 | Medium | 5.5 | — | 2026-08-17 | Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. |
CVE-2026-5241 | Critical | 9.6 | — | 2026-06-03 | A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. |
CVE-2026-4372 | High | 7.8 | — | 2026-05-24 | A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. |
CVE-2026-1839 | High | 7.8 | — | 2026-04-07 | A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. |
CVE-2025-14930 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2025-14929 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2025-14928 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. |
CVE-2025-14927 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. |
CVE-2025-14926 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. |
CVE-2025-14924 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2025-14921 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2025-14920 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2025-6921 | High | 7.5 | — | 2025-09-23 | The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. |
CVE-2025-6051 | Medium | 5.3 | — | 2025-09-14 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. |
CVE-2025-6638 | High | 7.5 | — | 2025-09-12 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. |
CVE-2025-5197 | Medium | 5.3 | — | 2025-08-06 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. |
CVE-2025-3933 | Medium | 5.3 | — | 2025-07-11 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. |
CVE-2025-3777 | Low | 3.5 | — | 2025-07-07 | Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. |
CVE-2025-3264 | Medium | 5.3 | — | 2025-07-07 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-5241 | Critical | 9.6 | — | 2026-06-03 | A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. |
CVE-2024-3568 | Critical | 9.6 | — | 2024-04-10 | The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. |
CVE-2024-11394 | High | 8.8 | — | 2024-11-22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2024-11393 | High | 8.8 | — | 2024-11-22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2024-11392 | High | 8.8 | — | 2024-11-22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. |
CVE-2023-6730 | High | 8.8 | — | 2023-12-19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2026-80047 | High | 7.8 | — | 2026-09-01 | A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). |
CVE-2026-4372 | High | 7.8 | — | 2026-05-24 | A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. |
CVE-2026-1839 | High | 7.8 | — | 2026-04-07 | A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. |
CVE-2025-14930 | High | 7.8 | — | 2025-12-23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. |