Deserialization Of Untrusted Data

huggingface/transformers is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the implementation of TransfoXLTokenizer, which automatically loads the vocab.pkl file from the remote repository using the risky pickle.load function without any restrictions. This issue can be exploited by an attacker by tricking a user into loading malicious serialized data which can lead to remote code execution.