CVE-2026-4372
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
All versions of the HuggingFace transformers library prior to 5.3.0 contain a critical remote code execution vulnerability. An attacker can craft a malicious config.json file with the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads the model via AutoModelForCausalLM.from_pretrained(), the library downloads and executes arbitrary Python code from the attacker's repository with full OS privileges.
Risk Assessment
An attacker can remotely take over the victim's system without their knowledge, bypassing the trust_remote_code mechanism. This vulnerability is particularly severe as it exploits the standard documented usage pattern.
Recommendation
Upgrade the HuggingFace transformers library to version 5.3.0 or later immediately.
Other vulnerabilities in HuggingFace transformers
See all- CVE-2026-5241Critical
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization by overriding the trust_remote_code parameter with untrusted configuration data.
- CVE-2025-6921High
The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The _do_use_weight_decay method processes user-controlled regular expressions, which can cause catastrophic backtracking and 100% CPU utilization.
Original NVD description (English source)
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS