Hugging Face Transformers load_repo_checkpoint pickle RCE
Date: 2024-04
Affected: huggingface/transformers (multiple)
Attack vector: deserialization
Category: real-world
Severity: Critical
CVE: CVE-2023-2800
CVE-2023-6730
CVE-2023-7018
CVE-2024-11392
CVE-2024-11393
CVE-2024-11394
CVE-2024-12720
CVE-2024-3568
CVE-2025-1194
CVE-2025-2099
CVE-2025-3262
CVE-2025-3263
CVE-2025-3264
CVE-2025-3777
CVE-2025-3933
CVE-2025-5197
CVE-2025-6051
CVE-2025-6638
CVE-2025-6921
CVE-2026-1839
CVE-2026-4372
CWE: CWE-1066
CWE-1333
CWE-20
CWE-377
CWE-400
CWE-502
CVSS: 8.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L)

Hugging Face Transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data in load_repo_checkpoint() of TFPreTrainedModel. pickle.load on external checkpoint data enables RCE. The fix removed the function.


Mitigations:

Architectural layers (MAESTRO):