Skip to content
OpenAdvisories

Package · PyPI

transformers

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.8
    CVE-2026-4372 Public exploit

    Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers

    A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` f…

    huggingface huggingface/transformers transformers PyPI
  • High 8.8
    CVE-2024-11394 Public exploit

    Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is requir…

    Hugging Face Transformers transformers PyPI
  • High 8.8
    CVE-2024-11393 Public exploit

    Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is …

    Hugging Face Transformers transformers PyPI
  • High 7.5
    CVE-2024-11392 Public exploit

    Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

    Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is requi…

    Hugging Face Transformers transformers PyPI
  • Low 3.4
    CVE-2024-3568 Public exploit

    Arbitrary Code Execution via Deserialization in huggingface/transformers

    The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by craf…

    huggingface huggingface/transformers transformers PyPI