CVE-2024-3568Low· 3.4▾ TwilightPoC availableTransformers Deserialization of Untrusted Data vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 18.7 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.1%
2.1% → 2.1%
1 GitHub repo
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the load_repo_checkpoint() function of the TFPreTrainedModel() class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of pickle.load() on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.
transformers < 4.38.0Upgrade to a patched release:
transformers 4.38.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-11393High· 8.8Deserialization of Untrusted Data in Hugging Face Transformers
CVE-2024-11392High· 7.5Deserialization of Untrusted Data in Hugging Face Transformers
CVE-2024-11394High· 8.8Deserialization of Untrusted Data in Hugging Face Transformers
CVE-2026-9856High· 7.1A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal
CVE-2026-1839Medium· 6.5HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
CVE-2025-6051Medium· 5.3Hugging Face Transformers library has Regular Expression Denial of Service