Hugging Face Transformers EUVD-2026-60384

Exploitation requires that a victim uses the Hugging Face Transformers library to load a checkpoint whose index file was supplied or influenced by the attacker - either by downloading a malicious model from the Hub, receiving an archive from an untrusted source, or processing user-submitted model uploads in an application. The CVSS 4.0 vector UI:P confirms that user interaction (the act of loading the checkpoint) is mandatory; there is no remote network-reachable attack surface in the library itself. AV:L indicates the attack is local in the CVSS sense, meaning the attacker's malicious artifact must reach the local filesystem or be directly passed to the loader. Exploitation is limited by: (1) the victim must actively load a checkpoint from an untrusted source; (2) the process running the loader must have read access to the targeted files - privileged files such as /etc/shadow are inaccessible if inference runs as an unprivileged user; and (3) the attacker must know or guess valid absolute paths or traversal sequences to targeted files on the host.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H) assigns high confidentiality impact but scopes the attack as local with user interaction required, reflecting that the attacker must deliver a malicious checkpoint that the victim actively loads rather than exploiting a remotely reachable network service. Attack complexity is low once a malicious checkpoint is placed or distributed, and no privileges are required of the attacker. EPSS data was not provided in the intelligence package, which is a gap worth noting; however, the supply-chain distribution model for ML models - where practitioners routinely download and load checkpoints from the Hugging Face Hub or third-party sources - substantially lowers the practical delivery barrier and means even a mid-sized municipal IT team in opole running local inference pipelines should treat this as a meaningful risk if models are sourced outside curated internal registries. There is no KEV listing and no confirmed public exploit, suggesting exploitation is not yet widespread, but the attack primitive is simple and the potential exposure of credentials, SSH keys, and configuration files on inference servers makes this a genuine priority for teams consuming untrusted model artifacts. The wildcard CPE version range means no version of Transformers has been confirmed as patched in the available data.

An attacker publishes a model on the Hugging Face Hub or distributes a checkpoint archive containing an index file with shard entries such as '../../../etc/ssl/private/server.key'. When a developer or automated CI pipeline downloads and loads this model using the standard Transformers API (e.g., AutoModel.from_pretrained), the library resolves these crafted paths and opens the referenced files outside the model directory, disclosing their contents. No public exploit code has been confirmed, but the attack primitive requires only a text-editor and knowledge of the index file format.