CVE-2025-14929

🗓️ 23 Dec 2025 21:04:15Reported by zdiType

Deserialization flaw in Hugging Face Transformers X-CLIP checkpoint parsing enables remote code execution via malicious data.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	17 Mar 202611:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers-4.57.3-py3-none-any.whl which is vulnerable to CVE-2025-14920, CVE-2025-14921, CVE-2025-14924, CVE-2025-14926, CVE-2025-14927, CVE-2025-14928, CVE-2025-14929.	2 Mar 202613:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses transformers-4.53.0-py3-none-any.whl which is vulnerable to multiple CVEs.	27 Feb 202611:37	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	31 Mar 202612:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Hugging Face Transformers bundled with IBM Fusion, IBM Fusion HCI and Content-Aware Storage	13 May 202610:51	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	14 May 202613:48	–	ibm
Circl	CVE-2025-14929	18 Dec 202505:00	–	circl
CNNVD	Hugging Face Transformers 代码问题漏洞	23 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-14929 Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability	23 Dec 202521:04	–	cvelist
EUVD	EUVD-2025-204830	23 Dec 202521:30	–	euvd

NVD

Vulners

Node

huggingface transformersMatch5.0.0rc0

[
  {
    "vendor": "Hugging Face",
    "product": "Transformers",
    "versions": [
      {
        "version": "d1c6310d6a02481d48d81607cba7840be04580d1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-25-1144/

21 Jan 2026 16:38Current

7.9High risk

Vulners AI Score7.9

CVSS 37.8

EPSS0.00234

SSVC

CWE-502