Hugging Face Transformers vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20258
3. 20261

Newest CVEs

• CVE-2026-80047

  Hugging Face Transformers library writes remote code to disk prior to consent check

  Hugging Face · Transformers

  High7.8
• CVE-2025-14930

  Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2025-14928

  Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2025-14924

  Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2025-14920

  Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2025-14926

  Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2025-14927

  Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2025-14921

  Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2025-14929

  Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High7.8
• CVE-2024-11394

  Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Hugging Face · Transformers

  High8.8