Transformers vulnerabilities

CVEs whose affected-version data names the Transformers package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

20 CVEsRSS

CVE-2026-80047High· 7.8

3w ago

Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers (versions >= 4.49.0 and <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches …

▾ TwilightHugging Face · TransformersEPSS 0.08%via CVEORG

CVE-2026-9856High· 7.1

1mo ago

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of `PreTrainedTokenizerBase` and `ProcessorMix…

Transformers vulnerabilities

Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

HuggingFace transformers vulnerable to remote code execution

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Hugging Face Transformers library has Regular Expression Denial of Service

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking

Transformers's Improper Input Validation vulnerability can be exploited through username injection

Transformers vulnerable to ReDoS attack through its get_imports() function

Transformers vulnerable to ReDoS attack through its SETTING_RE variable

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Deserialization of Untrusted Data in Hugging Face Transformers

Deserialization of Untrusted Data in Hugging Face Transformers

Deserialization of Untrusted Data in Hugging Face Transformers

Transformers Deserialization of Untrusted Data vulnerability