Skip to content
OpenAdvisories

Product · Hugging Face

huggingface/transformers

20 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.8
    CVE-2026-4372 Public exploit

    Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers

    A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` f…

    Hugging Face huggingface/transformers transformers PyPI