Hugging Face Transformers CVE-2025-14920

Exploitation requires the victim to load/open an attacker-controlled model file parsed by the Transformers Perceiver model code path; the serialized model data is deserialized without proper validation of user-supplied input (CWE-502). Limiting factors per the CVSS vector: it is NOT remotely triggerable over the network (AV:L) and REQUIRES user interaction (UI:R) - the target must be induced to visit a malicious page or open/load a malicious model file. No authentication or special privileges are needed on the attacker side (PR:N), and code runs only in the context of the current user (S:U), so impact is bounded by that user's privileges rather than automatic privilege escalation.

This is a CWE-502 deserialization-to-RCE flaw in Hugging Face Transformers (ZDI-25-1150 / ZDI-CAN-25423). The provided CVSS:3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) and the ZDI description are internally consistent: although the title and prose say 'remote attackers,' the vector is correctly AV:L with UI:R - exploitation is not network-reachable but requires the victim to load/open a malicious model file locally, so 'remote' here means attacker-supplied content, not a listening-service attack. Real-world urgency is moderate rather than acute: EPSS is low at 0.36% (28th percentile), the CVE is NOT on CISA KEV, and no public exploit is referenced - the only source is the ZDI advisory. So despite a High (7.8) CVSS and full C/I/A impact, the dominant signal set (low EPSS, no KEV, no POC, mandatory user interaction, local vector) points to a credible-but-not-widespread threat driven by social-engineering delivery of untrusted models rather than automatable mass exploitation. Note the description/title say 'remote' while the CVSS vector says AV:L - this is the standard ZDI file-parsing pattern and is not a true conflict, but defenders should treat the true attack surface as 'untrusted model file loading,' not an exposed network port.

An attacker publishes a weaponized model repository (or sends a malicious model file / link) that embeds a malicious serialized object; a data scientist or CI pipeline loads the model with a vulnerable Transformers version, triggering deserialization of untrusted data during parsing of the Perceiver model files and executing arbitrary code as the current user. Because the CVSS vector is AV:L/AC:L with UI:R, exploitation is low-complexity but hinges entirely on the victim being induced to open or load the malicious model. No public exploit code is identified at time of analysis.