Hugging Face Transformers CVE-2025-14927

Exploitation requires the victim to invoke the convert_config function (the SEW-D checkpoint/config conversion path) on an attacker-controlled checkpoint - i.e. the target must deliberately convert a malicious model checkpoint (UI:R). The attack vector is local (AV:L): the malicious checkpoint must be present and processed on the victim's machine, so there is no network-reachable, unauthenticated entry point. No special privileges are required (PR:N) and attack complexity is low (AC:L), so once a malicious checkpoint is loaded for conversion, execution is reliable. LIMITING FACTORS: the mandatory user/pipeline action of converting an untrusted checkpoint, the local vector, and the fact that code executes only with the privileges of the current user (S:U, no privilege escalation). Environments that only process trusted first-party checkpoints are not realistically exposed.

This is a moderate-priority, not a top-tier emergency, vulnerability. The CVSS 3.0 score of 7.8 is driven by HIGH impact to confidentiality, integrity, and availability (full arbitrary code execution as the current user), but the vector explicitly states AV:L (local) and UI:R (user interaction required) - the victim must actively convert a malicious checkpoint. These two signals substantially blunt real-world risk: this is not a remotely-reachable, self-propagating flaw despite the title containing 'Remote Code Execution'. EPSS corroborates the lower urgency at 0.34% (26th percentile), indicating low predicted exploitation probability. There is no CISA KEV listing and no public proof-of-concept identified in the provided data, so exploitation is theoretical at this time. CONFLICTING SIGNAL TO NOTE: the description repeatedly says 'remote attackers' while the CVSS vector encodes AV:L (local) - this is characteristic of ZDI 'open-a-malicious-file' categorizations where delivery may be remote (e.g. a downloaded checkpoint) but the exploitation action is local; treat the attack as file-borne rather than network-reachable and verify with the ZDI advisory. Overall this is a 'high-CVSS-but-conditional-real-risk' issue: dangerous in ML/MLOps pipelines that auto-convert untrusted third-party checkpoints, but low mass-exploitation potential.

An attacker publishes a weaponized SEW-D model checkpoint to a public model hub or sends it directly to a target. When a developer or an automated pipeline uses Transformers' convert_config routine to convert that checkpoint, the unvalidated attacker-supplied string is evaluated as Python, executing arbitrary code in the context of the current user. No public exploit code was identified at time of analysis, so exploitation currently requires the attacker to craft the malicious checkpoint themselves.