HuggingFace Transformers Remote Code Execution Vulnerability
Evidence indicates that HuggingFace Transformers is affected by remote code execution.
RESOLVED
What Happened
Evidence indicates that HuggingFace Transformers is affected by remote code execution.
Why This Matters
The evidence matters to defenders using HuggingFace Transformers because it could let an attacker run code in affected environments.
Recommended Action
No confirmed vendor remediation is available in the current evidence. Confirm whether HuggingFace Transformers is present in your environment and review the affected configuration.
Exposure
Exposure unknown
Apr 07, 2026 12:00
Exposure reason: This incident does not currently match a technology in My Interests.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Apr 07, 2026 12:00BugSkan first recorded this incident.
-
HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
Apr 07, 2026 12:00GitHub Advisory Database · Vulnerability
-
HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
Apr 07, 2026 12:00OSV.dev · Vulnerability
Sources
GitHub Advisory Database · Apr 07, 2026 12:00
A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.
Open publisher sourceOSV.dev · Apr 07, 2026 12:00
A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.
Open publisher sourceMy Interests Match
Create an account to see which incidents overlap with your interests.