Remote Code Execution Flaw in Hugging Face Diffusers Product Suite
CVE-2025-14922

7.8HIGH

Key Information:

Vendor

Hugging Face

Status
Diffusers
Vendor
CVE Published:
23 December 2025

What is CVE-2025-14922?

A vulnerability exists in Hugging Face Diffusers due to improper validation of user-supplied data during the parsing of checkpoints. This flaw could allow remote attackers to execute arbitrary code on affected installations when users visit a malicious page or open a harmful file. Attackers can exploit this weakness to run code in the context of the current process, potentially compromising system integrity.

Affected Version(s)

Diffusers 22a452a526660363b57216cd011ce75345382d02

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1142/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.