Security brief
Transformers configuration flaw could load attacker-controlled generation code
REVIEWCVE-2026-4372 involved an internal attention-implementation setting in untrusted model configuration.
What happened
The advisory for CVE-2026-4372 describes a Transformers model-loading path that accepted an internal configuration field pointing to an attacker-controlled repository. Loading the crafted model could download and execute Python code with the user’s privileges.
The documented issue could bypass the intended remote-code trust mechanism. It concerns a specific library behavior, not evidence that every model hosted on Hugging Face contains malicious code.
The advisory lists versions below 5.3.0 as affected and 5.3.0 as fixed. Use a maintained release and isolate untrusted model processing, keeping deployment credentials and sensitive files outside the loading environment.
Next step
Update Transformers and isolate loading of untrusted model configurations.
What we know
- Fixed version
- 5.3.0.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
OSV
Technical details
- CVE
CVE-2026-4372