Hugging Face Transformers CVE-2025-14928

Exploitation requires the victim to load and run the convert_config conversion path on an attacker-supplied HuBERT checkpoint in Hugging Face Transformers 4.57.0; the malicious checkpoint carries a crafted string that convert_config fails to validate before executing as Python code. Limiting factors: this is a local attack (AV:L) demanding active user interaction (UI:R) - the user must deliberately convert the hostile checkpoint - so there is no remote, unauthenticated, network-triggered path and no mass-exploitation vector. Code runs only in the context of the current user (S:U), bounded by that user's privileges, and the attacker must first get the malicious checkpoint in front of a victim who performs the conversion.

This is a genuine but conditional risk rather than a drop-everything emergency. The provided CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: despite the title calling it 'Remote Code Execution', the vector correctly scores it as a LOCAL attack vector (AV:L) requiring user interaction (UI:R) - the victim must actively load/convert an attacker-supplied malicious HuBERT checkpoint. The 'remote' framing refers to the attacker delivering a malicious artifact (e.g. via a public model hub), not to network-reachable exploitation; defenders should treat this as a supply-chain/malicious-file issue, not an internet-facing service flaw. Supporting signals are modest: EPSS is low at 0.34% (26th percentile), there is NO CISA KEV listing, and no public exploit code is referenced - only the ZDI advisory. The low EPSS is consistent with the UI:R requirement, which caps mass-automated exploitation. No SSVC decision data was supplied. Net: a high-impact (full C/I/A compromise of the user context) but attacker-dependent-on-social-engineering issue affecting a hugely popular ML library - prioritize patching for any workflow that ingests third-party checkpoints, but it does not carry the automatable, network-wormable profile of top-tier emergencies.

An attacker publishes a trojanized HuBERT model checkpoint to a public model hub or sends it directly to a victim. When the victim loads and runs the conversion routine, the convert_config function passes an attacker-controlled string into Python execution without validation, running arbitrary code with the victim's privileges. No public proof-of-concept is referenced beyond the ZDI advisory, and the local vector plus required user interaction mean exploitation hinges on tricking the user into converting the malicious checkpoint.