Remote Code Execution Vulnerability in Hugging Face Transformers
CVE-2025-14921

7.8HIGH

Key Information:

Vendor

Hugging Face

Status
Transformers
Vendor
CVE Published:
23 December 2025

What is CVE-2025-14921?

This vulnerability exposes installations of Hugging Face Transformers to potential remote code execution when model files are parsed without proper validation of user-supplied data. An attacker can exploit this flaw by crafting a malicious page or file that, when accessed by a victim, allows them to execute arbitrary code within the context of the user. User interaction is necessary for the exploit to succeed, heightening the importance of secure coding practices and user awareness.

Affected Version(s)

Transformers 9c8bd3fc1befe54f3efb9f385561eef49f060a70

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1149/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.