EUVD-2026-19573
GHSA-69w3-r845-3855
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7Blast Radius
ecosystem impact- 33 pypi packages depend on transformers (22 direct, 11 indirect)
Ecosystem-wide dependent count for version 5.0.0rc3.
DescriptionCVE.org
A vulnerability in the HuggingFace Transformers library, specifically in the Trainer class, allows for arbitrary code execution. The _load_rng_state() method in src/transformers/trainer.py at line 3059 calls torch.load() without the weights_only=True parameter. This issue affects all versions of the library supporting torch>=2.2 when used with PyTorch versions below 2.6, as the safe_globals() context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as rng_state.pth, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.
AnalysisAI
Remote code execution in HuggingFace Transformers library allows arbitrary code execution via malicious checkpoint files. The _load_rng_state() method in the Trainer class calls torch.load() without the weights_only=True parameter, enabling deserialization attacks when PyTorch versions below 2.6 are used with torch>=2.2. An attacker can craft a malicious rng_state.pth checkpoint file that executes arbitrary code when loaded by an application using affected Transformers versions. The fix is available in version v5.0.0rc3, and no public exploit has been independently confirmed at time of analysis.
Technical ContextAI
The vulnerability stems from unsafe deserialization in PyTorch's torch.load() function, which can execute arbitrary Python code embedded in serialized objects (CWE-502: Deserialization of Untrusted Data). The HuggingFace Transformers library's Trainer class uses _load_rng_state() to restore random number generator state from checkpoint files during training resumption. In PyTorch versions below 2.6, the safe_globals() context manager does not restrict code execution during deserialization. When torch>=2.2 is combined with PyTorch <2.6, the library loads checkpoint files without specifying weights_only=True, which would restrict deserialization to tensor data only. The affected CPE (cpe:2.3:a:huggingface:huggingface/transformers:*:*:*:*:*:*:*:*) indicates all versions of the Transformers library are potentially vulnerable when used with the vulnerable PyTorch configuration.
RemediationAI
Upgrade HuggingFace Transformers to version v5.0.0rc3 or later, which addresses the unsafe deserialization by ensuring weights_only=True is specified in torch.load() calls. For users unable to immediately upgrade, restrict access to checkpoint files and validate their origin before loading, particularly in shared environments. Ensure PyTorch is updated to version 2.6 or later if feasible, as this version provides enhanced protection via the safe_globals() context manager. The upstream fix is documented in GitHub commit 03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396 (https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396) and additional details are available from the HuntrAI bounty report (https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485).
More in Huggingface Transformers
View allRemote code execution in HuggingFace Transformers prior to 5.3.0 allows attackers to achieve arbitrary code execution on
Arbitrary file write via path traversal in HuggingFace Transformers (<=5.8.0.dev0, fixed in 5.10.0) enables a supply-cha
Same weakness CWE-502 – Deserialization of Untrusted Data
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today