Code Injection Vulnerability in Hugging Face Transformers by Hugging Face
CVE-2025-14927

7.8HIGH

Key Information:

Vendor

Hugging Face

Status
Transformers
Vendor
CVE Published:
23 December 2025

What is CVE-2025-14927?

A code injection vulnerability in the convert_config function of Hugging Face Transformers enables remote attackers to execute arbitrary code. This risk arises when a user unknowingly converts a malicious checkpoint, ultimately executing user-supplied strings without proper validation. Attackers can exploit this vulnerability within the context of the current user, making it crucial for users to be cautious and ensure they apply all security updates.

Affected Version(s)

Transformers 4.57.0

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1148/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.