PT-2024-26627 · Hugging Face · Huggingface/Transformers

Rocketknight1 · Published 2024-04-10 · Updated 2025-10-10 · CVE-2024-3568

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions huggingface/transformers (affected versions not specified)

Description The issue allows for arbitrary code execution through deserialization of untrusted data within the load repo checkpoint() function of the TFPreTrainedModel() class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of pickle.load() on data from potentially untrusted sources. This enables remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-3568

GHSA-37Q5-V5QM-C9V8

Affected Products

Huggingface/Transformers

References · 9

• 🔥 https://huntr.com/bounties/b3c36992-5264-4d7f-9906-a996efafba8f · Exploit
• https://github.com/huggingface/transformers/commit/693667b8ac8138b83f8adb6522ddaf42fa07c125 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3568 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3568 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-37q5-v5qm-c9v8 · Vendor Advisory
• https://github.com/huggingface/transformers · Note
• https://twitter.com/VulmonFeeds/status/1778132859372322879 · Twitter Post
• https://twitter.com/CVEnew/status/1778118901844336963 · Twitter Post
• https://t.me/cveNotify/138193 · Telegram Post