Huggingface / Transformers
31 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-80047 | Hugging Face Transformers library writes remote code to disk prior to consent check | HIGH | 7.8 | Sep 1, 2026 |
| CVE-2026-75104 | Hugging Face Transformers Path Traversal via Checkpoint Index | MEDIUM | 6.8 | Aug 17, 2026 |
| CVE-2026-5241 | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers | CRITICAL | 9.6 | Jun 3, 2026 |
| CVE-2026-4372 | Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers | HIGH | 7.8 | May 24, 2026 |
| CVE-2026-1839 | Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers | HIGH | 7.8 | Apr 7, 2026 |
| CVE-2025-14930 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-14928 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-14924 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-14920 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-14926 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-14927 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-14921 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-14929 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH | 8.8 | Dec 23, 2025 |
| CVE-2025-6921 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | HIGH | 7.5 | Sep 23, 2025 |
| CVE-2025-6051 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | MEDIUM | 5.3 | Sep 14, 2025 |
| CVE-2025-6638 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | HIGH | 7.5 | Sep 12, 2025 |
| CVE-2025-5197 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | MEDIUM | 5.3 | Aug 6, 2025 |
| CVE-2025-3933 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | MEDIUM | 5.3 | Jul 11, 2025 |
| CVE-2025-3777 | Improper Input Validation in huggingface/transformers | LOW | 3.5 | Jul 7, 2025 |
| CVE-2025-3264 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | MEDIUM | 5.3 | Jul 7, 2025 |
| CVE-2025-3263 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | MEDIUM | 5.3 | Jul 7, 2025 |
| CVE-2025-3262 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | HIGH | 7.5 | Jul 7, 2025 |
| CVE-2025-2099 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | HIGH | 7.5 | May 19, 2025 |
| CVE-2025-1194 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | MEDIUM | 6.5 | Apr 29, 2025 |
| CVE-2024-12720 | Regular Expression Denial of Service (ReDoS) in huggingface/transformers | HIGH | 7.5 | Mar 20, 2025 |
Showing 1 to 25 of 31 CVEs