Huggingface Transformers
30 CVEs affecting Huggingface Transformers. Latest disclosed: 2026-06-03. Critical: 2, High: 20.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5241 | Critical | 9.6 | 2026-06-03 | A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitra… |
CVE-2024-3568 | Critical | 9.6 | 2024-04-10 | The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` fu… |
CVE-2024-11394 | High | 8.8 | 2024-11-22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2024-11393 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2024-11392 | High | 8.8 | 2024-11-22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec… |
CVE-2023-6730 | High | 8.8 | 2023-12-19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2026-4372 | High | 7.8 | 2026-05-24 | A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows… |
CVE-2026-1839 | High | 7.8 | 2026-04-07 | A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` meth… |
CVE-2025-14930 | High | 7.8 | 2025-12-23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2025-14929 | High | 7.8 | 2025-12-23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote… |
CVE-2025-14928 | High | 7.8 | 2025-12-23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2025-14927 | High | 7.8 | 2025-12-23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-14926 | High | 7.8 | 2025-12-23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-14924 | High | 7.8 | 2025-12-23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2025-14921 | High | 7.8 | 2025-12-23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2025-14920 | High | 7.8 | 2025-12-23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2023-7018 | High | 7.8 | 2023-12-20 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. |
CVE-2025-6921 | High | 7.5 | 2025-09-23 | The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer… |
CVE-2025-6638 | High | 7.5 | 2025-09-12 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenize… |
CVE-2025-3262 | High | 7.5 | 2025-07-07 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vul… |