Is transformers safe ? 24 known vulnerabilities, worst severity CRITICAL.
// reach 85 direct dependencies
27 carry known advisories, worst CRITICAL
384 packages depend on it
an advisory here reaches each of them
esm inference-gpu lettucedetect modelscope stable-diffusion-sdkit stepaudio2-minicpmo // ai models 3,794 published models carry an advisory from this package
7 pin a version the advisory is confirmed against; the rest declare it without a version.
3,862 published models
38 declared · 2895 observed · 651 inferred
3862 published AI models are associated with this package: 38 name it in a requirements or pyproject file, 2895 load it or import it directly, and 651 are inferred from the runtime stack their declared library pulls in. Only 32 state a version requirement, so this is not a count of affected models.
cvss CVSS v3.0 base score out of 10
epss chance of exploitation in 30 days, 61st percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-3863-2447-669p, the advisory selected below
// 24 advisories GHSA-3863-2447-669p Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. CRIT GHSA-x9r9-c232-4q39 A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such a HIGH GHSA-xrqw-3rrv-vx5w A vulnerability in huggingface/transformers versions < 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chat_template dictionary are used directly as filenames without proper validation. An attacker can exploit this by publishing a malicious Hugging Fa HIGH GHSA-fgcw-684q-jj6r A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trust_remote_code parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when load HIGH GHSA-29pf-2h5f-8g72 A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard AutoModelForCausalLM.from_pre HIGH GHSA-hxxf-235m-72v3 Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. HIGH GHSA-qxrp-vhvm-j765 Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. HIGH GHSA-wrfc-pvp9-mr9g Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. HIGH GHSA-v68g-wm8c-6x7j Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. HIGH GHSA-69w3-r845-3855 A vulnerability in the HuggingFace Transformers library, specifically in the Trainer class, allows for arbitrary code execution. The _load_rng_state() method in src/transformers/trainer.py at line 3059 calls torch.load() without the weights_only=True parameter. This issue affects all versions of the library supporting torch>=2.2 when used with PyTorch versions below 2.6, as the safe_globals() cont MODE Show all 24 advisories Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0.
// cvss v3.0 vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability High Checked 2026-11-06 at 20:56 UTC. The most recent advisory here was published 2026-09-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page