Hugging Face Transformers
12 CVEs affecting Hugging Face Transformers. Latest disclosed: 2026-09-01. Critical: 0, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11394 | High | 8.8 | 2024-11-22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2024-11393 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11392 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2026-80047 | High | 7.8 | 2026-09-01 | A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using… |
CVE-2025-14930 | High | 7.8 | 2025-12-23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2025-14929 | High | 7.8 | 2025-12-23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote… |
CVE-2025-14928 | High | 7.8 | 2025-12-23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2025-14927 | High | 7.8 | 2025-12-23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-14926 | High | 7.8 | 2025-12-23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-14924 | High | 7.8 | 2025-12-23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2025-14921 | High | 7.8 | 2025-12-23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2025-14920 | High | 7.8 | 2025-12-23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |