Hugging Face
Monthly
Deserialization of untrusted data in Hugging Face Accelerate's checkpoint parsing allows arbitrary code execution in the context of the current process when a user or automated pipeline loads a malicious checkpoint file. The CVSS:3.0 vector (AV:L/AC:L/PR:N/UI:R) means the attacker must get the file to the target locally and the victim must actively load it - there is no remote network-service trigger - so environments that only load self-produced, trusted checkpoints are not at risk. No public exploit code or active exploitation is identified in the available intelligence, and EPSS is low at 0.37% (29th percentile); risk is genuine but conditional on loading third-party or untrusted checkpoints.
Arbitrary code execution in Hugging Face Transformers 4.55.0 occurs when the library parses an attacker-supplied megatron_gpt2 model checkpoint, because checkpoint data is deserialized without adequate validation (CWE-502). The attack is not remotely triggerable on its own: the CVSS vector is AV:L with UI:R, so a victim must actively open a malicious file or visit a page that causes the crafted checkpoint to be loaded, and any code then runs with the privileges of the loading process or user. This is a genuine but second-tier priority - the EPSS score is only 0.33% (25th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis; realistic exposure is confined to workflows that ingest third-party or otherwise untrusted checkpoints. The issue was reported through Trend Micro ZDI as ZDI-CAN-27984 / ZDI-25-1141.
Deserialization of untrusted data in Hugging Face Diffusers' CogView4 checkpoint-parsing path lets an attacker who supplies a crafted serialized checkpoint execute arbitrary code in the context of the current process when the victim loads it. The attack is local in vector (AV:L) and requires user interaction (UI:R) - the target must open a malicious file or visit a malicious page that triggers the CogView4 loader - so exposure is concentrated in workflows that routinely ingest third-party or community-sourced model weights rather than in internet-facing services. Severity is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with an EPSS of only 0.37% (29th percentile); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and reported signals are consistent with a genuine but condition-gated code-execution risk rather than an internet-wormable emergency.
Deserialization of untrusted data in Hugging Face Accelerate's checkpoint parsing allows arbitrary code execution in the context of the current process when a user or automated pipeline loads a malicious checkpoint file. The CVSS:3.0 vector (AV:L/AC:L/PR:N/UI:R) means the attacker must get the file to the target locally and the victim must actively load it - there is no remote network-service trigger - so environments that only load self-produced, trusted checkpoints are not at risk. No public exploit code or active exploitation is identified in the available intelligence, and EPSS is low at 0.37% (29th percentile); risk is genuine but conditional on loading third-party or untrusted checkpoints.
Arbitrary code execution in Hugging Face Transformers 4.55.0 occurs when the library parses an attacker-supplied megatron_gpt2 model checkpoint, because checkpoint data is deserialized without adequate validation (CWE-502). The attack is not remotely triggerable on its own: the CVSS vector is AV:L with UI:R, so a victim must actively open a malicious file or visit a page that causes the crafted checkpoint to be loaded, and any code then runs with the privileges of the loading process or user. This is a genuine but second-tier priority - the EPSS score is only 0.33% (25th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis; realistic exposure is confined to workflows that ingest third-party or otherwise untrusted checkpoints. The issue was reported through Trend Micro ZDI as ZDI-CAN-27984 / ZDI-25-1141.
Deserialization of untrusted data in Hugging Face Diffusers' CogView4 checkpoint-parsing path lets an attacker who supplies a crafted serialized checkpoint execute arbitrary code in the context of the current process when the victim loads it. The attack is local in vector (AV:L) and requires user interaction (UI:R) - the target must open a malicious file or visit a malicious page that triggers the CogView4 loader - so exposure is concentrated in workflows that routinely ingest third-party or community-sourced model weights rather than in internet-facing services. Severity is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with an EPSS of only 0.37% (29th percentile); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and reported signals are consistent with a genuine but condition-gated code-execution risk rather than an internet-wormable emergency.