Hugging Face Transformers
12 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-80047 | 4.57.0 – 5.16.1 | Hugging Face Transformers library writes remote code to disk prior to consent check | HIGH 7.8 | 0.1 % | ||
| CVE-2025-14930 | 4.57.1 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 7.8 | 0.3 % | ||
| CVE-2025-14928 | 4.57.0 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability | HIGH 7.8 | 0.3 % | ||
| CVE-2025-14924 | 95faabf0a6cd845f4c5548697e288a79e424b096 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 7.8 | 0.3 % | ||
| CVE-2025-14920 | 9c8bd3fc1befe54f3efb9f385561eef49f060a70 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 7.8 | 0.4 % | ||
| CVE-2025-14926 | 4.57.0 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability | HIGH 7.8 | 0.3 % | ||
| CVE-2025-14927 | 4.57.0 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability | HIGH 7.8 | 0.3 % | ||
| CVE-2025-14921 | 9c8bd3fc1befe54f3efb9f385561eef49f060a70 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 7.8 | 0.3 % | ||
| CVE-2025-14929 | d1c6310d6a02481d48d81607cba7840be04580d1 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 7.8 | 0.4 % | ||
| CVE-2024-11394 | 026a173a64372e9602a16523b8fae9de4b0ff428 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8.8 | 2.6 % | ||
| CVE-2024-11393 | 8820fe8b8c4b9da94cf1e4761876f85c562e0efe | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8.8 | 3.1 % | ||
| CVE-2024-11392 | 940fde8dafaecb8f17b588c5078291f1c1a420c8 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8.8 | 7.3 % |