Huggingface vulnerabilities

Products

• Transformers 31
• Huggingface/transformers 20
• Diffusers 5
• Smolagents 5
• Datasets 3
• Huggingface/smolagents 2
• Huggingface/text-generation-inference 2
• Lerobot 2

Newest

• huggingface datasets Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder CVE-2026-57845 Public exploit 8.7 HighOctober 23, 2026
• huggingface tokenizers tokenizers BpeBuilder Buffer Overflow via merge token CVE-2026-85670 Fix available 7.1 HighSeptember 4, 2026
• hugging face transformers Hugging Face Transformers Path Traversal via Checkpoint Index CVE-2026-75104 6.8 MediumAugust 17, 2026
• hugging face accelerate Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map CVE-2026-69112 6.9 MediumAugust 10, 2026
• huggingface peft peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules CVE-2026-71281 8.8 HighAugust 5, 2026
• huggingface huggingface/transformers Path Traversal in huggingface/transformers CVE-2026-9856 Fix available 7.1 HighAugust 2, 2026
• huggingface datasets Datasets Path Traversal via Unsanitized file_name Metadata CVE-2026-66007 Fix available 6.9 MediumJuly 24, 2026
• huggingface datasets Datasets Symlink-following Arbitrary File Write via Extractor.extract() CVE-2026-65010 4.4 MediumJuly 23, 2026
• huggingface diffusers Diffusers Path Traversal via weight_map Arbitrary File Read CVE-2026-65920 5.3 MediumJuly 23, 2026
• huggingface text-generation-inference text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions CVE-2026-63086 6.9 MediumJuly 16, 2026
• huggingface huggingface/transformers, transformers, red hat openshift lightspeed +7 more +9 more Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVE-2026-5241 Fix available 8.0 HighJune 3, 2026
• huggingface huggingface/transformers, transformers +1 more Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers CVE-2026-4372 Public exploitFix available 7.8 HighMay 24, 2026
• huggingface diffusers Diffusers: TOCTOU Trust Remote Code Bypass CVE-2026-45804 Fix available 7.5 HighMay 20, 2026
• huggingface diffusers, red hat ai inference server, enterprise linux ai (rhel ai) 3 +2 more +4 more Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components CVE-2026-44513 Fix available 8.8 HighMay 7, 2026
• huggingface diffusers Diffusers: None.py Trust Remote Code Bypass CVE-2026-44827 Fix available 8.8 HighMay 7, 2026
• hugging face lerobot LeRobot Unsafe Deserialization Remote Code Execution via gRPC CVE-2026-25874 EPSS 15.5% 9.3 CriticalApril 23, 2026
• huggingface huggingface/transformers, transformers +1 more Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers CVE-2026-1839 Fix available 6.5 MediumApril 7, 2026
• huggingface smolagents huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection CVE-2026-4963 5.3 MediumMarch 27, 2026
• huggingface smolagents huggingface smolagents LocalPythonExecutor requests.post server-side request forgery CVE-2026-2654 5.3 MediumFebruary 18, 2026
• huggingface huggingface/text-generation-inference Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference CVE-2026-0599 Fix available EPSS 29.5% 7.5 HighFebruary 2, 2026
• hugging face diffusers Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14922 7.8 HighDecember 23, 2025
• hugging face smolagents Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14931 10.0 CriticalDecember 23, 2025
• hugging face transformers Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14930 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14928 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14924 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14920 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14926 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14927 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14921 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14929 7.8 HighDecember 23, 2025
• huggingface smolagents, huggingface/smolagents +1 more XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function CVE-2025-11844 Public exploitFix available 5.4 MediumOctober 22, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-6921 Fix available 5.3 MediumSeptember 23, 2025
• hugging face lerobot huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication CVE-2025-10772 5.3 MediumSeptember 21, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-6051 Fix available 5.3 MediumSeptember 14, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-6638 Fix available 5.3 MediumSeptember 12, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-5197 Fix available 5.3 MediumAugust 6, 2025
• huggingface huggingface/smolagents, smolagents +1 more Sandbox Escape Vulnerability in huggingface/smolagents CVE-2025-5120 Fix available EPSS 31.2% 7.6 HighJuly 27, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3933 Fix available 5.3 MediumJuly 11, 2025
• huggingface huggingface/transformers, transformers +1 more Improper Input Validation in huggingface/transformers CVE-2025-3777 Fix available 3.5 LowJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3264 Fix available 5.3 MediumJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3263 Fix available 5.3 MediumJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3262 Fix available 5.3 MediumJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-2099 Fix available 5.3 MediumMay 19, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-1194 Fix available 4.3 MediumApril 29, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2024-12720 Fix available 5.3 MediumMarch 20, 2025
• hugging face transformers Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11394 Public exploitFix available 8.8 HighNovember 22, 2024
• hugging face transformers Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11393 Public exploitFix available 8.8 HighNovember 22, 2024
• hugging face transformers Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11392 Public exploitFix available 7.5 HighNovember 22, 2024
• huggingface huggingface/text-generation-inference, text generation inference +1 more Code Injection in huggingface/text-generation-inference CVE-2024-3924 Fix available 4.4 MediumMay 30, 2024
• huggingface huggingface/transformers, transformers +1 more Arbitrary Code Execution via Deserialization in huggingface/transformers CVE-2024-3568 Public exploitFix available 3.4 LowApril 10, 2024
• Show olderLoading…