CVE-2024-11393

🗓️ 22 Nov 2024 21:23:38Reported by zdiType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 291 Views🌐 WEB

Hugging Face Transformers MaskFormer Model Deserialization Vulnerabilit

Reporter	Title	Published	Views	Family All 29
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has vulnerabilities due to transformers package (CVE-2024-11392, CVE-2024-11393, CVE-2024-11394)	17 Jul 202518:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.46.3-py3-none-any.whl CVE-2024-12720	13 May 202507:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	8 May 202523:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to Remote Code Execution in Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	30 May 202515:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.	9 May 202509:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Hugging Face Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]	2 Apr 202517:21	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in Python wheel package for the Hugging Face Transformers library affecting watsonx Code Assistant On Prem Extensions	27 Mar 202515:39	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Huggingface Transformers	7 Dec 202411:24	–	githubexploit
Chainguard	CVE-2024-11393 vulnerabilities	22 Nov 202422:15	–	cgr
Circl	CVE-2024-11393	19 Nov 202406:00	–	circl

NVD

Vulners

Node

huggingface transformersRange<4.48.0

[
  {
    "vendor": "Hugging Face",
    "product": "Transformers",
    "versions": [
      {
        "version": "8820fe8b8c4b9da94cf1e4761876f85c562e0efe",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-1514/

Parameter	Position	Path	Description	CWE
--checkpoint_path	path	transformers/src/transformers/models/maskformer/convert_maskformer_swin_to_pytorch.py	Unsafe deserialization of untrusted data via pickle.load in the convert_maskformer_swin_to_pytorch.py script leading to remote code execution when a malicious checkpoint is provided.	CWE-502

17 Jun 2026 06:57Current

9High risk

Vulners AI Score9

CVSS 3.18.8

CVSS 38.8

EPSS0.02894

SSVC

CWE-502