Skip to content

Hugging Face vulnerabilities

Products

Newest

hugging face lerobot CVE-2026-115533 CVE-2026-115533 No scoreOctober 26, 2026
hugging face text embeddings inference Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging CVE-2026-108857 4.8 MediumOctober 11, 2026
hugging face transformers Hugging Face Transformers library writes remote code to disk prior to consent check CVE-2026-80047 Fix available 7.8 HighSeptember 1, 2026
hugging face pytorch image models Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2026-15679 7.8 HighAugust 20, 2026
hugging face transformers Hugging Face Transformers Path Traversal via Checkpoint Index CVE-2026-75104 6.8 MediumAugust 17, 2026
hugging face accelerate Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map CVE-2026-69112 6.9 MediumAugust 10, 2026
hugging face accelerate Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation CVE-2025-9266 4.3 MediumAugust 6, 2026
hugging face sentence-transformers sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False CVE-2026-68770 Fix available 9.3 CriticalJuly 31, 2026
hugging face lerobot LeRobot Unsafe Deserialization Remote Code Execution via gRPC CVE-2026-25874 EPSS 15.5% 9.3 CriticalApril 23, 2026
hugging face accelerate Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14925 7.8 HighDecember 23, 2025
hugging face diffusers Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14922 7.8 HighDecember 23, 2025
hugging face smolagents Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14931 10.0 CriticalDecember 23, 2025
hugging face transformers Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14930 7.8 HighDecember 23, 2025
hugging face transformers Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14928 7.8 HighDecember 23, 2025
hugging face transformers Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14924 7.8 HighDecember 23, 2025
hugging face transformers Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14920 7.8 HighDecember 23, 2025
hugging face transformers Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14926 7.8 HighDecember 23, 2025
hugging face transformers Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14927 7.8 HighDecember 23, 2025
hugging face transformers Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14921 7.8 HighDecember 23, 2025
hugging face transformers Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14929 7.8 HighDecember 23, 2025
hugging face lerobot huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication CVE-2025-10772 5.3 MediumSeptember 21, 2025
hugging face transformers Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11394 Public exploitFix available 8.8 HighNovember 22, 2024
hugging face transformers Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11393 Public exploitFix available 8.8 HighNovember 22, 2024
hugging face transformers Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11392 Public exploitFix available 7.5 HighNovember 22, 2024