PT-2025-52378 · Hugging Face · Hugging Face Transformers Perceiver Model

The_Kernel_Panic · Published 2025-12-18 · Updated 2026-01-21 · CVE-2025-14920

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers Perceiver Model (affected versions not specified)

Description A flaw exists in the parsing of model files within Hugging Face Transformers Perceiver Model, stemming from insufficient validation of user-supplied data. This can lead to the deserialization of untrusted data, potentially allowing a remote attacker to execute code in the context of the current user. User interaction is required, as the target must visit a malicious page or open a malicious file to trigger the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-14920

PYSEC-2025-211

ZDI-25-1150

Affected Products

Hugging Face Transformers Perceiver Model

References · 7

• https://zerodayinitiative.com/advisories/ZDI-25-1150 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14920 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-211 · Vendor Advisory
• https://twitter.com/CVEnew/status/2003700583660966230 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2003623763456266486 · Twitter Post
• https://t.me/cveNotify/149419 · Telegram Post