EUVD-2026-31598
GHSA-29pf-2h5f-8g72
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (huntr_ai) · only source for this CVE.
CVSS VectorVendor: huntr_ai
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Blast Radius
ecosystem impact- 73 pypi packages depend on transformers (54 direct, 20 indirect)
Ecosystem-wide dependent count for version 5.3.0.
DescriptionCVE.org
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard AutoModelForCausalLM.from_pretrained() API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the trust_remote_code security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.
AnalysisAI
Remote code execution in HuggingFace Transformers prior to 5.3.0 allows attackers to achieve arbitrary code execution on a victim's machine by publishing a malicious model whose config.json sets the _attn_implementation_internal field to an attacker-controlled Hub repository. When the victim calls the standard AutoModelForCausalLM.from_pretrained() API, the library silently downloads and executes Python kernels from that repository with the victim's privileges, bypassing the trust_remote_code safety gate. No public exploit is identified at time of analysis (EPSS 0.03%, SSVC exploitation: none), but the technical impact is total and the attack uses the documented, default usage pattern.
Technical ContextAI
HuggingFace Transformers is the dominant Python library for loading and running transformer-based ML models, identified by CPE cpe:2.3:a:huggingface:huggingface/transformers. The root cause maps to CWE-1066 (missing serialization control element): the PretrainedConfig.__init__ constructor in src/transformers/configuration_utils.py blindly applied setattr for every key in a user-supplied config.json, including internal-only fields prefixed with underscore such as _attn_implementation_internal and _experts_implementation_internal. Those fields are subsequently consumed by the Hub kernels integration (integrations/hub_kernels.py), which previously accepted any <owner>/<repo> pattern and fetched/executed the referenced kernel module. The combination - unfiltered deserialization of an internal field, plus an unsandboxed kernel-fetch-and-execute path that did not honor trust_remote_code - converts model loading into arbitrary code execution. The fix denylists the two internal fields during deserialization and restricts kernel loading to the trusted kernels-community namespace.
RemediationAI
Vendor-released patch: upgrade transformers to version 5.3.0 or later (pip install --upgrade 'transformers>=5.3.0'), which both blocks deserialization of _attn_implementation_internal and _experts_implementation_internal from hub configs and restricts kernel loading to the kernels-community namespace (commit a7f8e7ff37d87d1a1a0c8cf607971c607741452f). If immediate upgrade is not possible, compensating controls include pinning model loads to a curated allowlist of known-good repository IDs/revisions and rejecting any config.json whose keys include _attn_implementation_internal or _experts_implementation_internal before passing it to from_pretrained(); running model loading inside a network-egress-restricted sandbox (container with no outbound access to huggingface.co except a proxied mirror, or seccomp/firejail) limits the kernel download step, at the cost of breaking any legitimate dynamic kernel fetching. Note that setting trust_remote_code=False does NOT mitigate this issue because the vulnerability bypasses that mechanism. Vendor and advisory links: https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f and https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today