Hugging Face Transformers: HuggingFace transformers vulnerable to remote code execution
Hugging Face Transformers
More for Hugging Face Transformers RSS feed for Hugging Face Transformers
- Severity
- High, CVSS 7.8
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-4372
- Affects
- Hugging Face Transformers
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 24, 2026
- Source last modified
- July 23, 2026
Description
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard AutoModelForCausalLM.from_pretrained() API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the trust_remote_code security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.
Description quoted from the NVD record.
Who is affected
Hugging Face Transformers is a software library that programmers use to download and run AI models. This flaw affects all versions before 5.3.0. If someone at your organization loads an AI model that an attacker has set up, using the normal, documented way of loading models, the library can download and run the attacker's own program on that computer with the same full permissions as the person using it. This happens even though the product has a safety switch meant to block outside code, and the person loading the model would not notice anything. This flaw is rated High.
What to do
- The person who installed or looks after any AI projects or tools at your organization that use Hugging Face Transformers should handle this. If you are not sure whether anyone uses it, ask your developers or your IT provider.
- Update Hugging Face Transformers to version
5.3.0or later on every computer and server where it is installed. - If an IT provider, outside developer or vendor runs these tools for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of July 23, 2026 and reviewed before publishing.