CVE-2026-4372

HighCVSS 7.8

Published: 24/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

39th percentile - higher than 39% of all known CVEs

Summary

All versions of the HuggingFace transformers library prior to 5.3.0 contain a critical remote code execution vulnerability. An attacker can craft a malicious config.json file with the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads the model via AutoModelForCausalLM.from_pretrained(), the library downloads and executes arbitrary Python code from the attacker's repository with full OS privileges.

Risk Assessment

An attacker can remotely take over the victim's system without their knowledge, bypassing the trust_remote_code mechanism. This vulnerability is particularly severe as it exploits the standard documented usage pattern.

Recommendation

Upgrade the HuggingFace transformers library to version 5.3.0 or later immediately.

Other vulnerabilities in HuggingFace transformers

CVE-2026-5241Critical
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization by overriding the trust_remote_code parameter with untrusted configuration data.

Original NVD description (English source)

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.