Huggingface Transformers vulnerabilities

• hugging face transformers Hugging Face Transformers Path Traversal via Checkpoint Index CVE-2026-75104 6.8 MediumAugust 17, 2026
• huggingface huggingface/transformers Path Traversal in huggingface/transformers CVE-2026-9856 Fix available 7.1 HighAugust 2, 2026
• huggingface huggingface/transformers, transformers, red hat openshift lightspeed +7 more +9 more Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVE-2026-5241 Fix available 8.0 HighJune 3, 2026
• huggingface huggingface/transformers, transformers +1 more Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers CVE-2026-4372 Public exploitFix available 7.8 HighMay 24, 2026
• huggingface huggingface/transformers, transformers +1 more Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers CVE-2026-1839 Fix available 6.5 MediumApril 7, 2026
• hugging face transformers Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14930 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14928 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14924 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14920 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14926 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability CVE-2025-14927 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14921 7.8 HighDecember 23, 2025
• hugging face transformers Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2025-14929 7.8 HighDecember 23, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-6921 Fix available 5.3 MediumSeptember 23, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-6051 Fix available 5.3 MediumSeptember 14, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-6638 Fix available 5.3 MediumSeptember 12, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-5197 Fix available 5.3 MediumAugust 6, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3933 Fix available 5.3 MediumJuly 11, 2025
• huggingface huggingface/transformers, transformers +1 more Improper Input Validation in huggingface/transformers CVE-2025-3777 Fix available 3.5 LowJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3264 Fix available 5.3 MediumJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3263 Fix available 5.3 MediumJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-3262 Fix available 5.3 MediumJuly 7, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-2099 Fix available 5.3 MediumMay 19, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2025-1194 Fix available 4.3 MediumApril 29, 2025
• huggingface huggingface/transformers, transformers +1 more Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVE-2024-12720 Fix available 5.3 MediumMarch 20, 2025
• hugging face transformers Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11394 Public exploitFix available 8.8 HighNovember 22, 2024
• hugging face transformers Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11393 Public exploitFix available 8.8 HighNovember 22, 2024
• hugging face transformers Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2024-11392 Public exploitFix available 7.5 HighNovember 22, 2024
• huggingface huggingface/transformers, transformers +1 more Arbitrary Code Execution via Deserialization in huggingface/transformers CVE-2024-3568 Public exploitFix available 3.4 LowApril 10, 2024
• huggingface huggingface/transformers, transformers +1 more Deserialization of Untrusted Data in huggingface/transformers CVE-2023-7018 Fix available 9.6 CriticalDecember 20, 2023
• huggingface huggingface/transformers, transformers +1 more Deserialization of Untrusted Data in huggingface/transformers CVE-2023-6730 Fix available 9.0 CriticalDecember 19, 2023
• huggingface huggingface/transformers, transformers +1 more Insecure Temporary File in huggingface/transformers CVE-2023-2800 Fix available 4.7 MediumMay 18, 2023