Hugging Face Transformers CVE-2025-14921

Exploitation requires the victim to load/open an attacker-supplied Transformer-XL model file in Hugging Face Transformers; the flaw is in the parsing of model files where user-supplied data is deserialized without proper validation (CWE-502). Key limiting factors: the CVSS vector is AV:L with UI:R, meaning there is no direct network attack surface - the attacker must socially engineer the target into visiting a malicious page or opening a malicious model file. No authentication is required (PR:N), and impact is confined to the current user's context (S:U), so code runs with the victim's privileges rather than escalated. Affected version per CPE is huggingface transformers 4.54.1.

This is a genuine-but-conditional code-execution risk rather than a mass-exploitation emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is notable because the 'remote attackers' framing in the description is reconciled by the LOCAL attack vector combined with required user interaction (UI:R): the victim must be convinced to load/open a malicious model file, so exploitation is user-triggered rather than a directly network-reachable server flaw. No privileges are required (PR:N) and complexity is low (AC:L), so once a victim opens a weaponized Transformer-XL model, deserialization (CWE-502) yields full C/I/A impact in that user's context. The real-world signals point AWAY from urgent widespread risk: EPSS is only 0.33% (25th percentile), the CVE is NOT on CISA KEV, and no public exploit code was provided in the input. There is no SSVC decision data in the input to assess automatable/exploitation state. Net: a credible RCE in a very popular ML library, but gated behind social engineering and low observed exploitation probability - prioritize as a patch-in-normal-cycle item for ML/data-science environments, not a drop-everything KEV-tier incident. Note the mismatch to flag: the description's 'remote attackers' wording versus the CVSS AV:L local vector - the operative model is 'attacker-supplied file opened locally,' not remote network exploitation.

An attacker publishes or shares a malicious Transformer-XL model file (e.g., on a model hub, via a link, or an email attachment) crafted to trigger unsafe deserialization when parsed. A data scientist or engineer loads that model using Hugging Face Transformers, and the embedded payload executes arbitrary code in the user's context. No public exploit code was identified in the provided data, but the low attack complexity (AC:L) makes a working exploit straightforward to construct once the deserialization path is known.