Hugging Face Transformers CVE-2025-14926

Exploitation requires the victim to load and convert a maliciously crafted SEW model checkpoint through the convert_config function, which executes an unvalidated user-supplied string as Python code (CWE-94). The hard limiting factor is mandatory user interaction (UI:R) combined with a local attack vector (AV:L): the attacker cannot trigger this over the network and must get the target to actively process an untrusted checkpoint file. There is no authentication or privilege prerequisite on the attacker side (PR:N), and code runs only with the privileges of the user performing the conversion (S:U), not elevated. Realistic exposure is therefore limited to environments that ingest third-party/untrusted model checkpoints; pipelines that only process trusted internal models are not practically exposed.

This is a genuine but conditional code-execution risk rather than a mass-exploitation emergency. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, low-complexity flaw with no privileges required but mandatory user interaction - the victim must actively load/convert an attacker-supplied SEW checkpoint. Although PR:N technically means 'unauthenticated,' the AV:L + UI:R combination makes this a social-engineering/supply-chain style issue (malicious model file) rather than a remotely-reachable network service bug, despite the title calling it 'Remote Code Execution.' Corroborating signals point to lower urgency: EPSS is only 0.34% (26th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced. Exploitation status: no public exploit identified at time of analysis. The sole source is the Trend Micro ZDI advisory (ZDI-25-1147 / ZDI-CAN-28251), a credible vendor-coordinated disclosure, which raises confidence in the technical finding but provides no evidence of in-the-wild use. Net: prioritize patching for anyone converting untrusted model checkpoints, but this is not a drop-everything, internet-facing worm-class flaw.

An attacker publishes a malicious SEW model checkpoint on a model hub or sends it directly to a victim. When a data scientist loads and converts that checkpoint, the unvalidated string in the convert_config function is executed as Python code, running arbitrary commands in the context of the current user. No public proof-of-concept is referenced, and exploitation requires the victim to perform the conversion (UI:R), consistent with the local, low-complexity CVSS vector.