EUVD-2026-19573
GHSA-69w3-r845-3855
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 30 pypi packages depend on transformers (22 direct, 8 indirect)
Ecosystem-wide dependent count for version 5.0.0rc3.
DescriptionCVE.org
A vulnerability in the HuggingFace Transformers library, specifically in the Trainer class, allows for arbitrary code execution. The _load_rng_state() method in src/transformers/trainer.py at line 3059 calls torch.load() without the weights_only=True parameter. This issue affects all versions of the library supporting torch>=2.2 when used with PyTorch versions below 2.6, as the safe_globals() context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as rng_state.pth, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.
AnalysisAI
Remote code execution in HuggingFace Transformers library allows arbitrary code execution via malicious checkpoint files. The _load_rng_state() method in the Trainer class calls torch.load() without the weights_only=True parameter, enabling deserialization attacks when PyTorch versions below 2.6 are used with torch>=2.2. An attacker can craft a malicious rng_state.pth checkpoint file that executes arbitrary code when loaded by an application using affected Transformers versions. The fix is available in version v5.0.0rc3, and no public exploit has been independently confirmed at time of analysis.
Technical ContextAI
The vulnerability stems from unsafe deserialization in PyTorch's torch.load() function, which can execute arbitrary Python code embedded in serialized objects (CWE-502: Deserialization of Untrusted Data). The HuggingFace Transformers library's Trainer class uses _load_rng_state() to restore random number generator state from checkpoint files during training resumption. In PyTorch versions below 2.6, the safe_globals() context manager does not restrict code execution during deserialization. When torch>=2.2 is combined with PyTorch <2.6, the library loads checkpoint files without specifying weights_only=True, which would restrict deserialization to tensor data only. The affected CPE (cpe:2.3:a:huggingface:huggingface/transformers:*:*:*:*:*:*:*:*) indicates all versions of the Transformers library are potentially vulnerable when used with the vulnerable PyTorch configuration.
RemediationAI
Upgrade HuggingFace Transformers to version v5.0.0rc3 or later, which addresses the unsafe deserialization by ensuring weights_only=True is specified in torch.load() calls. For users unable to immediately upgrade, restrict access to checkpoint files and validate their origin before loading, particularly in shared environments. Ensure PyTorch is updated to version 2.6 or later if feasible, as this version provides enhanced protection via the safe_globals() context manager. The upstream fix is documented in GitHub commit 03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396 (https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396) and additional details are available from the HuntrAI bounty report (https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485).
More in Hugging Face
View allThe huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Arbitrary Python code execution in LMDeploy 0.12.1 through 0.12.2 lets an attacker who publishes a malicious model on Hu
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository,
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim process
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Server-side request forgery in HuggingFace text-generation-inference through version 3.3.7 enables unauthenticated remot
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, spe
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
XPath injection in Hugging Face Smolagents 1.20.0 lets an attacker who can influence the text passed to the vision web b
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being
Same weakness CWE-502 – Deserialization of Untrusted Data
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today