PYSEC-2025-216

🗓️ 23 Dec 2025 21:15:48Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Hugging Face Transformers HuBERT convert_config enables remote code execution via unvalidated user string.

Reporter	Title	Published	Views	Family All 22
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	17 Mar 202611:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers-4.57.3-py3-none-any.whl which is vulnerable to CVE-2025-14920, CVE-2025-14921, CVE-2025-14924, CVE-2025-14926, CVE-2025-14927, CVE-2025-14928, CVE-2025-14929.	2 Mar 202613:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses transformers-4.53.0-py3-none-any.whl which is vulnerable to multiple CVEs.	27 Feb 202611:37	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	31 Mar 202612:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Hugging Face Transformers bundled with IBM Fusion, IBM Fusion HCI and Content-Aware Storage	13 May 202610:51	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	14 May 202613:48	–	ibm
Circl	CVE-2025-14928	18 Dec 202505:00	–	circl
CNNVD	Hugging Face Transformers 代码注入漏洞	23 Dec 202500:00	–	cnnvd
CVE	CVE-2025-14928	23 Dec 202521:04	–	cve
Cvelist	CVE-2025-14928 Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability	23 Dec 202521:04	–	cvelist