Huggingface Transformers
Monthly
Arbitrary file write via path traversal in HuggingFace Transformers (<=5.8.0.dev0, fixed in 5.10.0) enables a supply-chain attacker to overwrite arbitrary files on a victim's filesystem. The flaw exists in `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where dictionary keys from the `chat_template` field in a downloaded `tokenizer_config.json` are used verbatim as filenames with no path sanitization. An attacker need only publish a malicious model repository on HuggingFace Hub; exploitation is triggered when the victim calls `save_pretrained()` after loading the poisoned model. No active exploitation is confirmed (not in CISA KEV), but the attack surface spans all practitioners using the affected `save_pretrained()` path across multiple popular processor families.
Remote code execution in HuggingFace Transformers prior to 5.3.0 allows attackers to achieve arbitrary code execution on a victim's machine by publishing a malicious model whose config.json sets the `_attn_implementation_internal` field to an attacker-controlled Hub repository. When the victim calls the standard `AutoModelForCausalLM.from_pretrained()` API, the library silently downloads and executes Python kernels from that repository with the victim's privileges, bypassing the `trust_remote_code` safety gate. No public exploit is identified at time of analysis (EPSS 0.03%, SSVC exploitation: none), but the technical impact is total and the attack uses the documented, default usage pattern.
Remote code execution in HuggingFace Transformers library allows arbitrary code execution via malicious checkpoint files. The `_load_rng_state()` method in the `Trainer` class calls `torch.load()` without the `weights_only=True` parameter, enabling deserialization attacks when PyTorch versions below 2.6 are used with torch>=2.2. An attacker can craft a malicious `rng_state.pth` checkpoint file that executes arbitrary code when loaded by an application using affected Transformers versions. The fix is available in version v5.0.0rc3, and no public exploit has been independently confirmed at time of analysis.
Arbitrary file write via path traversal in HuggingFace Transformers (<=5.8.0.dev0, fixed in 5.10.0) enables a supply-chain attacker to overwrite arbitrary files on a victim's filesystem. The flaw exists in `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMixin`, where dictionary keys from the `chat_template` field in a downloaded `tokenizer_config.json` are used verbatim as filenames with no path sanitization. An attacker need only publish a malicious model repository on HuggingFace Hub; exploitation is triggered when the victim calls `save_pretrained()` after loading the poisoned model. No active exploitation is confirmed (not in CISA KEV), but the attack surface spans all practitioners using the affected `save_pretrained()` path across multiple popular processor families.
Remote code execution in HuggingFace Transformers prior to 5.3.0 allows attackers to achieve arbitrary code execution on a victim's machine by publishing a malicious model whose config.json sets the `_attn_implementation_internal` field to an attacker-controlled Hub repository. When the victim calls the standard `AutoModelForCausalLM.from_pretrained()` API, the library silently downloads and executes Python kernels from that repository with the victim's privileges, bypassing the `trust_remote_code` safety gate. No public exploit is identified at time of analysis (EPSS 0.03%, SSVC exploitation: none), but the technical impact is total and the attack uses the documented, default usage pattern.
Remote code execution in HuggingFace Transformers library allows arbitrary code execution via malicious checkpoint files. The `_load_rng_state()` method in the `Trainer` class calls `torch.load()` without the `weights_only=True` parameter, enabling deserialization attacks when PyTorch versions below 2.6 are used with torch>=2.2. An attacker can craft a malicious `rng_state.pth` checkpoint file that executes arbitrary code when loaded by an application using affected Transformers versions. The fix is available in version v5.0.0rc3, and no public exploit has been independently confirmed at time of analysis.