Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1066: Missing Serialization Control Element

Base Incomplete Mapping prohibited

The product contains a serializable data element that does not
have an associated serialization method.

Source: MITRE CWE-1066

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.8
    CVE-2026-4372 Public exploit

    Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers

    A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` f…

    huggingface huggingface/transformers transformers PyPI