Hugging Face

16 CVEs across 6 Hugging Face products. Browse Hugging Face vulnerabilities, severities, and proof-of-concept exploits.

Hugging Face products with known CVEs

ProductCVEs
Transformers11
Accelerate1
Diffusers1
Lerobot1
Sentence-Transformers1
Smolagents1
Hugging Face CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-68770Critical9.82026-07-31sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in…
CVE-2026-25874Critical9.82026-04-23LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data receive…
CVE-2025-14931Critical10.02025-12-23Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacker…
CVE-2025-14930High7.82025-12-23Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb…
CVE-2025-14929High7.82025-12-23Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote…
CVE-2025-14928High7.82025-12-23Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit…
CVE-2025-14927High7.82025-12-23Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr…
CVE-2025-14926High7.82025-12-23Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar…
CVE-2025-14925High7.82025-12-23Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
CVE-2025-14924High7.82025-12-23Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex…
CVE-2025-14922High7.82025-12-23Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar…
CVE-2025-14921High7.82025-12-23Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacker…
CVE-2025-14920High7.82025-12-23Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
CVE-2024-11394High8.82024-11-22Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu…
CVE-2024-11393High8.82024-11-22Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
CVE-2024-11392High8.82024-11-22Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec…