repository icon
huggingface / transformers Project repository

🤗 Transformers: State-of-the-art Machine Learning for Pytorch, TensorFlow, and JAX.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN15 DAYS

FIX

WITHIN90 DAYS

Test: RCE in parakeet YAML FullLoader
radikhoroshev
self closed
SSRF via unvalidated image URL in transformers serve CLI (/v1/chat/completions)
minicoai
self closed
TOCTOU in Remote Code Loading
zafido
informative
High
Arbitrary Code Execution via Unsafe torch.load() in Multiple Conversion Scripts
0xbassia
informative
High
Arbitrary Code Execution via torch.load(weights_only=False) in Conversion Script...
seory0
informative
High
Unsafe torch.load() Deserialization in Newest Model Converters (edgetam_video, m...
nhomyk
informative
High
Systemic RCE via Insecure torch.load in Transformers Model Conversion Utilities
ccwlester26
informative
Critical
SSRF via unvalidated HTTP redirects in httpx.get() across 10 sinks (load_image,...
gengyscan
duplicate
High
Arbitrary Code Execution via `eval()` in SEW checkpoint conversion script
buttergolemcode
informative
High
Unsafe torch.load() in 8 HuggingFace Transformers Convert Scripts Enables RCE vi...
odysseypro25-project
duplicate
High
Unsafe torch.load() in 3 HuggingFace Transformers Convert Scripts Enables RCE vi...
odysseypro25-project
informative
High
Unsafe torch.load() Across 8 Convert Scripts in HuggingFace Transformers Enables...
odysseypro25-project
self closed
RCE via torch.load() without weights_only=True in convert_dia/eomt/janus scripts...
theoddesseyp-ai
informative
High
Pickle RCE in convert_maskformer_resnet_to_pytorch.py — pickle.load() on User-Su...
theoddesseyp-ai
informative
High
Pickle RCE in convert_maskformer_swin_to_pytorch.py — pickle.load() on User-Supp...
theoddesseyp-ai
informative
High
convert_csm.py and convert_higgs_audio_v2_tokenizer_to_hf.py Use cached_file() t...
theoddesseyp-ai
informative
High
Transformers convert_dia_to_hf.py, convert_janus_weights_to_hf.py, convert_eomt_...
theoddesseyp-ai
informative
High
Transformers convert_csm.py and convert_higgs_audio_v2_tokenizer_to_hf.py use ca...
theoddesseyp-ai
informative
High
Arbitrary Code Execution via Explicit torch.load(weights_only=False) in GLM4V an...
theoddesseyp-ai
informative
High
Arbitrary Code Execution via torch.load() Without weights_only in SAM2 and EdgeT...
theoddesseyp-ai
duplicate
High
Arbitrary Code Execution via torch.load(weights_only=False) in Multiple convert_...
theoddesseyp-ai
duplicate
High
Pickle RCE in convert_maskformer_resnet_to_pytorch.py via --checkpoint_path
theoddesseyp-ai
informative
High
Unsafe torch.load without weights_only=True in 100+ conversion scripts enables R...
narrator3333-hash
duplicate
High
Unsafe torch.load() without weights_only=True in 20+ Model Conversion Scripts (A...
elucidator-hky
self closed
Arbitrary code execution via eval() on model config data in Hubert, SEW, and SEW...
elucidator-hky
self closed
Remote Code Execution via unsafe torch.load() without weights_only=True in multi...
elucidator-hky
self closed
Path Traversal via tarfile.extractall() in parakeet convert_nemo_to_hf.py allows...
elucidator-hky
self closed
Arbitrary Code Execution via Unsafe torch.load() in 27+ Model Converter Scripts
appsecguardian-hash
informative
High
Arbitrary Code Execution via Unsafe torch.load() in Perception LM Conversion Scr...
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in Dia Conversion Script
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in Pixio Conversion Script
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in DINOv3-ConvNeXt Conversion S...
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in EoMT-DINOv3 Conversion Scrip...
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in EoMT Conversion Script (2 oc...
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in EdgeTAM Video Conversion Scr...
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in EdgeTAM Conversion Script
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in SAM3 Video Conversion Script
marcuschendev-cell
informative
High
Arbitrary Code Execution via Unsafe torch.load() in SAM3 Conversion Script
marcuschendev-cell
informative
None
Arbitrary Code Execution via Unsafe torch.load() in CSM Conversion Script
marcuschendev-cell
informative
None
Arbitrary Code Execution via Unsafe torch.load() and pickle.load() in NanoChat C...
marcuschendev-cell
informative
High
Unsafe Deserialization via bare torch.load in Transformers model loading utiliti...
etwithin
informative
High
Transformers SSRF via Unvalidated URL Fetching in Media Loading Functions - Acce...
avienma007
duplicate
Critical
Transformers SSRF via Unrestricted URL Fetching in Image/Video/Audio Pipelines
avienma007
self closed
Arbitrary Code Execution via Unguarded pickle.load() in Nanochat Converter
farouq7399
duplicate
High
RCE via explicit weights_only=False on remotely downloaded checkpoint in Higgs A...
avienma007
duplicate
Critical
RCE via torch.load() without weights_only=True in Multiple Conversion Scripts (w...
avienma007
self closed
Remote Code Execution via eval() in SEW-D Model Conversion Script
avienma007
duplicate
Critical
Remote Code Execution via unsafe pickle.load() and torch.load(weights_only=False...
avienma007
duplicate
High
Remote Code Execution via eval() in SEW-D Model Conversion Script
avienma007
duplicate
Critical
Tar Path Traversal in NeMo Model Converter Scripts Allows Arbitrary File Write
jeremysommerfeld8910-cpu
self closed
Tar Path Traversal in NeMo Model Converter Scripts Allows Arbitrary File Write
jeremysommerfeld8910-cpu
self closed
Tar Path Traversal in NeMo Model Converter Scripts Allows Arbitrary File Write
jeremysommerfeld8910-cpu
self closed
Tar Path Traversal in NeMo Model Converter Scripts Allows Arbitrary File Write
jeremysommerfeld8910-cpu
self closed
Tar Path Traversal in NeMo Model Converter Scripts Allows Arbitrary File Write
jeremysommerfeld8910-cpu
self closed
Tar path traversal via extractall() in NeMo model converter enables arbitrary fi...
jeremysommerfeld8910-cpu
self closed
Remote code execution via Hub kernel loading without trust_remote_code gate in a...
jeremysommerfeld8910-cpu
self closed
Regular expression Denial of Service - ReDoS
0xmanan
duplicate
Medium
Unsafe torch.load() and pickle.load() without TRUST_REMOTE_CODE gate in convert_...
mertsatilmaz
duplicate
High
Path Traversal via tar.extractall() in convert_nemo_to_hf.py allows arbitrary fi...
mertsatilmaz
duplicate
Medium
Unsafe torch.load() without weights_only=True in multiple new model conversion s...
optimus-fulcria
duplicate
High
Remote Code Execution via Insecure Deserialization in PatchTST/Trainer
samidsakib-max
duplicate
High
Runtime pickle.load() RCE on HuggingFace Hub Data in RAG Retrieval Module
morecitricacid-coder
duplicate
None
SSRF in image/video/audio loading — 13+ pipeline classes fetch arbitrary user-su...
wuqingyi20
duplicate
Critical
`trust_remote_code=False` Bypass in LightGlue Nested Config Loading Leads to Rem...
kimchikingdom
duplicate
Critical
`trust_remote_code=False` Is Ignored in LightGlue Nested Config Loading (Explici...
kimchikingdom
self closed
Runtime pickle.load() on HuggingFace Hub Data in RAG Retrieval Module
morecitricacid-coder
informative
High
Arbitrary Code Execution via unsafe eval() in distilHuBERT converter (convert_di...
kimchikingdom
duplicate
High
Missing TRUST_REMOTE_CODE Protection in nanochat Conversion Script Allows RCE vi...
loris4py
duplicate
High
Unsafe Pickle Deserialization in TextDataset Cache Loading (No TRUST_REMOTE_CODE...
yuvalelbar6
self closed
Arbitrary File Write in 'QuantizationConfig' (transformers)
yuvalelbar6
self closed
Arbitrary Code Execution (ACE) via Unsafe eval() in SEW/SEW-D Conversion Scripts
catalyzer9867
duplicate
Critical
Arbitrary Code Execution via Unsafe Deserialization in GLM4v Weight Conversion
catalyzer9867
duplicate
Critical
Server-Side Request Forgery (SSRF) via Video URL in load_video()
galanzi2580-wq
duplicate
High
Arbitrary Code Execution via Insecure Deserialization of Pickle Files
sebas5207418
informative
Critical
Arbitrary Code Execution via Insecure Pickle Deserialization in Reformer Model C...
pasigwilmer
self closed
Denial of Service via Unbounded URL Fetch and SSRF in transformers serve Image P...
seory0
duplicate
High
Unsafe YAML Deserialization via FullLoader in conversion scripts
squadan
informative
High
Remote Code Execution via eval() in checkpoint conversion scripts
squadan
duplicate
High
Transformers Model Converters Arbitrary Code Execution via torch.load()
responsiblereport10
duplicate
High
explicit weights\_only=false in lw-detr converter enables rce via malicious chec...
1seal
informative
High
Unsafe tar extraction of Hub-downloaded .nemo archives enables Zip Slip arbitrar...
theagentknownasren-gif
duplicate
None
SSRF in Transformers serve CLI VLM API image_url Parameter
mia-718ai
duplicate
High
HuggingFace Transformers Hub Kernels Supply Chain Remote Code Execution (RCE)
mia-718ai
duplicate
Critical
Arbitrary Code Execution via torch.hub.load in Transformers Conversion Scripts
l3ster1337
self closed
Deserialization of Untrusted Data leading to Remote Code Execution
l3ster1337
self closed
Arbitrary Code Execution via Unsafe torch.load(weights_only=False) in Model Conv...
sermikr0
duplicate
High
Path Traversal (Tarslip) in Hugging Face Transformers
locus-x64
duplicate
High
Arbitrary Code Execution via Unsafe Deserialization in convert_nanochat_checkpoi...
daddyjamwal
duplicate
High
Unpinned GenerationConfig downloads in Transformers CLI enable AI supply-chain p...
vlees46
pending
Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading
colemurray
Medium
•$125•CVE-2026-1839
Critical Remote Code Execution via Insecure Pickle Deserialization in HuggingFac...
abdallaabdalrhman
duplicate
Critical
Arbitrary Code Execution via Pickle Deserialization in TextDataset
vitalysim
duplicate
High
Arbitrary Code Execution via `eval()` in SEW-D Checkpoint Converter
vitalysim
duplicate
High
Path Traversal (Arbitrary File Read) in Hugging Face Transformers GLUE Data Proc...
stevenjulian1528
informative
Medium
Insecure Deserialization in RAG module's LegacyIndex allows Arbitrary Code Exe...
stevenjulian1528
duplicate
High
ZDI-CAN-28309: Hugging Face Transformers GLM4 Deserialization of Untrusted Data...
zdi-disclosures
duplicate
High
Remote Code Execution in Nanochat Converter via Unsafe Tokenizer Deserialization
jonnylitten
informative
High
Remote Code Execution via eval() in Fairseq Checkpoint Conversion Scripts
daridor9
duplicate
High
Exposed Hugging Face Hub Staging Token in Test Utilities
gyde04
informative
High
Exposed Hugging Face Hub Token in CircleCI Configuration
gyde04
informative
Critical
Arbitrary Directory Deletion via Symlink Attack in Transformers setup.py
manasharsh
informative
High
Remote Code Execution via unsafe torch.load() in LLaMA Weights Converter
daridor9
duplicate
High
Persistent Temp-File incomplete cleanup / resource exhaustion in `transformers`...
ava0-0sec
pending
Memory DoS in Doge Model MoE Layer
0xmrniko
informative
High
Downmix Implementation as Attack Vector Against Audio Transformer Models
kexinoh
informative
Medium
Malicious model on Hugging Face → Arbitrary File Write (TarSlip) in NeMo (Parake...
taiphung217
self closed
Critical RCE: Explicit weights_only=False in Megatron GPT-2 Checkpoint Converter
daridor9
duplicate
Critical
RCE via insecure pickle deserialization
sonw-vh
informative
Critical
Path Traversal Vulnerability in HuggingFace Transformers Model Conversion Script...
yousefabdelmohymen
informative
Medium
Path Traversal Leading to Arbitrary File Read
joelindra
informative
High
Path Traversal in Checkpoint Resumption
joelindra
informative
Critical
Server-Side Request Forgery (SSRF)
joelindra
informative
Critical
Insecure Deserialization leading to Remote Code Execution (RCE)
joelindra
duplicate
Critical
Path Traversal leading to Arbitrary File Write/Read
joelindra
informative
Critical
Division by Zero (Leading to Denial of Service)
joelindra
informative
High
Unsafe tarfile extraction allows directory traversal and arbitrary file overwrit...
slezzz
informative
High
Unsafe eval() usage in configuration parsing allows code execution
slezzz
duplicate
High
Unsafe torch.load() Without weights_only Parameter
slezzz
duplicate
High
Unrestricted CORS Configuration
swilliams9772
informative
Medium
Path Traversal in Archive Extraction (Zip/TarSlip)
swilliams9772
informative
High
Code Injection via Unsafe YAML Deserialization
swilliams9772
duplicate
Critical