Hugging Face Transformers CVE-2025-14929

Exploitation requires the victim to load or run the X-CLIP checkpoint conversion/parsing functionality in Hugging Face Transformers against an attacker-supplied checkpoint file (the deserialization occurs during checkpoint parsing). The required limiting factor is user interaction (UI:R): the target must actively open a malicious file or visit a malicious page that causes the crafted checkpoint to be loaded - there is no network-remote, zero-click path. Attack vector is local (AV:L), so the malicious checkpoint must reach and be processed on the victim's host. Risk is effectively confined to workflows that ingest untrusted or third-party model checkpoints; environments that only load trusted, internally produced checkpoints are not realistically exposed.

This is a CWE-502 deserialization-to-RCE flaw in Hugging Face Transformers' X-CLIP checkpoint conversion path, rated CVSS 7.8 (High). The CVSS 3.0 vector CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is internally consistent and credible: it is a local/file-borne attack (AV:L) requiring user interaction (UI:R) to load a malicious checkpoint, with no authentication (PR:N) and full CIA impact on the current process. The signals point to MODERATE real-world risk rather than emergency priority. Exploitation probability is low (EPSS 0.37%, 29th percentile), the CVE is NOT on CISA KEV, and there is no public exploit identified at time of analysis - so there is no evidence of active or automated exploitation. The high severity is driven by impact (code execution) and trivial technical complexity (AC:L), not by remote reachability; because it requires the victim to open an attacker-supplied checkpoint, it is a supply-chain / social-engineering vector rather than a mass-exploitable network bug. Note a potential tension for triagers: although PR:N marks it unauthenticated, exploitation is gated entirely by UI:R (a user must load the malicious file), so raw PR:N overstates ease of exploitation. This is a genuine but conditional risk best prioritized for environments that ingest untrusted model checkpoints.

An attacker publishes a malicious X-CLIP model checkpoint on a model hub or sends it to a victim, and the victim runs Transformers' checkpoint conversion/loading routine on it. Because the checkpoint is deserialized without validation of untrusted data (CWE-502), attacker-controlled payload executes arbitrary code in the context of the loading process. No public exploit is identified at time of analysis, but the technique (malicious pickle-style checkpoint) is well understood and complexity is low (AC:L).