CVE-2024-11392

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

7.5 HighPublic exploitFix available

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-24322.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

7.72%Up 7.7 points since Nov 23, 2024

What each source reports

CVE List Score used 7.5

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

Record: CVE-2024-11392
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2024-33791 7.5

Record: EUVD-2024-33791
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qxrp-vhvm-j765 7.5

Deserialization of Untrusted Data in Hugging Face Transformers

Record: GHSA-qxrp-vhvm-j765
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

NVD 8.8

Record: CVE-2024-11392
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 7.5

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

Record: CVE-2024-11392
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVGHSA-qxrp-vhvm-j765 7.5

Deserialization of Untrusted Data in Hugging Face Transformers

Record: GHSA-qxrp-vhvm-j765
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVPYSEC-2024-227 8.8

Record: PYSEC-2024-227
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`transformers` PyPI	before 4.48.0	4.48.0
`transformers` PyPI	before 4.48.0, plus listed versions 0.12.0.02.1.02.1.12.10.0 Show 45 moreShow less 2.11.02.2.02.2.12.2.22.3.02.4.02.4.12.5.02.5.12.6.02.7.02.8.02.9.02.9.13.0.03.0.13.0.23.1.03.2.03.3.03.3.13.4.03.5.03.5.14.0.04.0.0rc14.0.14.1.04.1.14.10.04.10.14.10.24.10.34.11.04.11.14.11.24.11.34.12.04.12.14.12.24.12.34.12.44.12.54.13.04.14.0	4.48.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Hugging Face Transformers MobileViTV2 4.41.1 - Remote Code Execution (RCE)	2025-04-16
PoC in GitHub	Piyush-Bhor/CVE-2024-11392	2024-12-07

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11392 is a high vulnerability (CVSS 7.5) in Hugging Face Transformers, published November 22, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.72%, the 94th percentile. Fixed in transformers 4.48.0.

References

This page doesn't list everything

Left out here: 116 versions. The JSON record has them.