PT-2026-42943 · Hugging Face · Transformers

Cyrilvallez · Published 2026-05-24 · Updated 2026-07-04 · CVE-2026-4372

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HuggingFace transformers versions prior to 5.3.0

Description A critical remote code execution issue exists where an attacker can craft a malicious config.json file. By setting the attn implementation internal field to a repository ID controlled by the attacker, arbitrary Python code is downloaded and executed with full OS privileges when a victim uses the AutoModelForCausalLM.from pretrained() API. This occurs due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The issue bypasses the trust remote code security mechanism and is triggered when the optional kernels package is installed. Affected versions were downloaded approximately 232 million times while the issue was live, potentially exposing cloud credentials, API keys, source code, and proprietary datasets.

Recommendations Upgrade to version 5.3.0 or later. Audit previously downloaded model configurations. Sandbox untrusted AI models to minimize risk.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-1066

Related Identifiers

CVE-2026-4372

GHSA-29PF-2H5F-8G72

PYSEC-2026-2289

Affected Products

Transformers

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4372.json · Exploit
• 🔥 https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884 · Exploit
• https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f · Patch
• https://osv.dev/vulnerability/GHSA-29pf-2h5f-8g72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4372 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4372 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2289 · Vendor Advisory
• https://github.com/huggingface/transformers · Note
• https://twitter.com/immeivise/status/2062973094432813080 · Twitter Post
• https://twitter.com/NewsNerdie/status/2058609573569655218 · Twitter Post
• https://t.me/CVEtracker/54780 · Telegram Post
• https://twitter.com/lyrie_ai/status/2073316174402597303 · Twitter Post
• https://t.me/cveNotify/166057 · Telegram Post
• https://twitter.com/integ_sec/status/2071960492222877746 · Twitter Post
• https://twitter.com/aiseceng/status/2059530139692658876 · Twitter Post