Regular expression Denial of Service - ReDoS

Description A regular expression denial of service ReDoS vulnerability has been identified in the Hugging Face Transformers library's configuration file resolution mechanism. The vulnerability exists in the getconfigurationfile function, which uses the vulnerable regular expression pattern...

PT-2025-28151

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers version 4.49.0 Description: A Regular Expression Denial of Service ReDoS issue was discovered in the Hugging Face Transformers library, specifically in the get configuration file function within the...

Picklescan Vulnerabilities Could Let Hackers Bypass AI Security Checks

Sonatype researchers uncover critical vulnerabilities in picklescan. Learn how these flaws impact AI model security, Hugging Face, and…...

Malicious ML Models on Hugging Face Leverage Broken Pickle Format to Evade Detection

Cybersecurity researchers have uncovered two malicious machine learning ML models on Hugging Face that leveraged an unusual technique of "broken" pickle files to evade detection. "The pickle files extracted from the mentioned PyTorch archives revealed the malicious Python content at the beginning...

Gradio < 4.18.0 Vulnerability - CVE-2024-2206

The version of Gradio installed on the remote host is prior to 4.18.0. It is, therefore, affected by an SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11394 Hugging Face Transformers Trax Model Deseri...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11393 Hugging Face Transformers MaskFormer Model D...

CVE-2024-11394

A flaw was found in the Trax model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...

CVE-2024-11393

A flaw was found in the MaskFormer model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...

CVE-2024-11392

A flaw was found in the MobileViTV2 model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to execute code in the context of the current user...

GHSA-HXXF-235M-72V3 Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...

Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in...

Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...

Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...

EUVD-2024-34103

Deserialization of Untrusted Data in Hugging Face Transformers...

GHSA-WRFC-PVP9-MR9G Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...

GHSA-QXRP-VHVM-J765 Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in...

CVE-2024-11393

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...

CVE-2024-11394

Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...

PYSEC-2024-228

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...