CVE-2026-23001-Hugging-Face-Transformers-Model-Deserialization-Arbitrary-Code-via-Pickle-

CVE-2026-23001 – Hugging Face Transformers 模型反序列化远程代码执行 概述 使用 torch.save 保存的 Hugging Face 模型采用 Python 的 pickle 序列化，这本身是不安全的。如果用户从存储库下载了一个看似合法的模型，加载该模型就可能触发任意代码执行，从而危及整个环境。 漏洞详情 类型： 不安全反序列化 影响： 远程代码执行 根本原因： torch.load 未对 pickle 反序列化进行沙箱隔离；攻击者可以注入 reduce 方法，从而执行 shell 命令。 漏洞演示 1. 生成恶意模型： pip instal...

CVE-2024-11393

CVE-2024-11393 Hugging Face Transformers MaskFormer 模型反序列化不可信数据远程代码执行漏洞 漏洞高级概述及影响： 攻击者可以通过向 Hugging Face Transformers 仓库中的 convertmaskformerswintopytorch.py 脚本提供恶意的 maskformer resnet 检查点文件，在目标主机上执行任意代码。 如果不知情的用户使用了第三方的 maskformer resnet 检查点文件，执行 convertmaskformerswintopytorch.py 脚本将导致受害者系统上的远程代码执...

CVE-2024-11392

CVE-2024-11392 Hugging Face Transformers MobileViTV2 における信頼できないデータのデシリアライゼーションによるリモートコード実行の脆弱性 脆弱性の概要と影響: この脆弱性により、攻撃者は悪意のある設定ファイルをHugging Face Transformersリポジトリの convertmlcvnetstopytorch.py スクリプトに提供することで、ホストマシン上で任意のコードを実行できます。 見知らぬユーザーが悪意のある設定ファイルを伴うサードパーティモデルを使用し、convertmlcvnetstopytorch.py...

Pickle-Deserialization-Exploit-in-Transformers

Transformers における pickle 逆シリアル化脆弱性の悪用 実験概要 pickle 逆シリアル化メカニズムとそのreduce攻撃原理を紹介し、Hugging Face Transformers ライブラリの逆シリアル化脆弱性CVE-2024-3568を再現し、Transformers ライブラリのセキュリティ上の問題を分析して、効果的なセキュリティ強化策を提案します。詳細は実験PDFドキュメントを参照 。 （POC作者のコードはCVE-2024-3568またはauthorinf フォルダを参照） 重要情報 1. 脆弱性の箇所...

CVE-2026-80047

A flaw was found in the Hugging Face Transformers library. A remote attacker could exploit this vulnerability by enticing a user to load a model using the GenerativePreTrainedModel.loadcustomgenerate function. This function writes remote Python files to the local disk without requiring explicit...

CVE-2024-11394

CVE-2024-11394 Hugging Face Transformers Trax モデルにおける信頼できないデータのデシリアライズによるリモートコード実行の脆弱性 脆弱性の概要と影響： 攻撃者は、悪意のある reformer trax チェックポイントファイルを、Hugging Face Transformers リポジトリ内の convertreformertraxcheckpointtopytorch.py スクリプトに提供することで、ホストマシン上で任意のコードを実行できます。 無防備なユーザーがサードパーティの reformer trax...

Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

PYSEC-2026-4174 Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

PT-2026-105917

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load custom generate. The function fetches and caches a remote module file before performing the required trust...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-75104 DESCRIPTION: Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers c...

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows...

CVE-2026-75104

A flaw was found in Hugging Face Transformers. Attackers can exploit this by supplying malicious checkpoint index files with parent-directory references or absolute paths that are not properly validated. This vulnerability allows for reading arbitrary files outside the model directory, leading to...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by transformers(Publicly disclosed vulnerability) ( CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568 Vulnerability Details CVEID:CVE-2024-11393 DESCRIPTION: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code...

Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

GHSA-X9R9-C232-4Q39 Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-80047

A vulnerability in Hugging Face Transformers versions 4.57.0 to 5.16.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-80047 Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers versions 4.57.0 to 5.16.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-80047 Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers versions 4.57.0 to 5.16.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-80047

Hugging Face Transformers (versions 4.49.0 through 5.8.1) contains a consent-bypass flaw in GenerativePreTrainedModel.load_custom_generate() . The function fetches and writes a remote Python module to ~/.cache/huggingface/modules via an unconditional file copy in dynamic_module_utils.py before ev...

EUVD-2026-69144

A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...