Remote Code Execution Vulnerability in Hugging Face Accelerate by Hugging Face

CVE-2025-14925

What is CVE-2025-14925?

The Hugging Face Accelerate product contains a vulnerability that enables remote attackers to execute arbitrary code on affected systems. This security flaw arises due to inadequate validation of user-provided data during the parsing of checkpoints. An attacker can exploit this vulnerability by luring users into visiting a malicious webpage or opening a compromised file, resulting in the deserialization of untrusted data, and subsequently executing code in the context of the current process.

References