What’s Vulnerable › Products
huggingface/transformers vulnerabilities
33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 26 published in the last 12 months.
Check whether your huggingface/transformers version is affected
Latest huggingface/transformers vulnerabilities
- CVE-2026-80047 — Hugging Face Transformers library writes remote code to disk prior to consent check (CVSS 7.8)
- CVE-2026-75104 — Hugging Face Transformers Path Traversal via Checkpoint Index (CVSS 5.5)
- CVE-2026-9856 — Path Traversal in huggingface/transformers (CVSS 7.1)
- CVE-2026-5241 — Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers (CVSS 9.6)
- CVE-2026-4372 — Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers (CVSS 7.8)
- CVE-2026-1839 — Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers (CVSS 7.8)
- CVE-2025-14930 — Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-14929 — Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-14928 — Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-14927 — Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-14926 — Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-14924 — Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-14921 — Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-14920 — Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8)
- CVE-2025-6921 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 7.5)
- CVE-2025-6051 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3)
- CVE-2025-6638 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 7.5)
- CVE-2025-5197 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3)
- CVE-2025-3933 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3)
- CVE-2025-3777 — Improper Input Validation in huggingface/transformers (CVSS 3.5)
- CVE-2025-3264 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3)
- CVE-2025-3263 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3)
- CVE-2025-3262 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 7.5)
- CVE-2025-2099 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 7.5)
- CVE-2025-1194 — Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 6.5)