Technology
Hugging Face Transformers
-
REVIEW
Transformers downloaded custom-generation code before asking for trust consent
CVE-2026-80047 concerns a premature cache write; the advisory explicitly distinguishes downloading code from executing it.
-
REVIEW
Transformers chat-template names could escape the intended save directory
CVE-2026-9856 involved path traversal when saving tokenizers or processors loaded from crafted repositories.
-
REVIEW
LightGlue loading flaw could override a caller’s remote-code trust choice
CVE-2026-5241 involved nested configuration loading in Transformers, with a fix listed in version 5.5.0.
-
REVIEW
Transformers configuration flaw could load attacker-controlled generation code
CVE-2026-4372 involved an internal attention-implementation setting in untrusted model configuration.
-
REVIEW
Transformers Trainer checkpoint flaw depended on the PyTorch version in use
CVE-2026-1839 involved unsafe loading of RNG state from an attacker-controlled checkpoint, rather than a generic PyTorch service breach.