PT-2025-52378 · Hugging Face · Hugging Face Transformers Perceiver Model

The_Kernel_Panic · Publicado 2025-12-18 · Atualizado 2026-01-21 · CVE-2025-14920

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers Perceiver Model (affected versions not specified)

Description A flaw exists in the parsing of model files within Hugging Face Transformers Perceiver Model, stemming from insufficient validation of user-supplied data. This can lead to the deserialization of untrusted data, potentially allowing a remote attacker to execute code in the context of the current user. User interaction is required, as the target must visit a malicious page or open a malicious file to trigger the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2025-14920

PYSEC-2025-211

ZDI-25-1150

Produtos afetados

Hugging Face Transformers Perceiver Model

Referências · 7

• https://zerodayinitiative.com/advisories/ZDI-25-1150 · Nota de Segurança
• https://twitter.com/CVEnew/status/2003700583660966230 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-14920 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2003623763456266486 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14920 · Nota de Segurança
• https://t.me/cveNotify/149419 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2025-211 · Aviso do Fabricante