{"items":[{"id":"NVI-00017718","kind":"vulnerability","title":"HuggingFace transformers vulnerable to remote code execution","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-29pf-2h5f-8g72","CVE-2026-4372"],"plain_summary":"GitHub lists this reviewed advisory for transformers. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4e76070071d57ac40f5e2368ab1650ad"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-01T18:00:11.000Z","value":"7.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4e76070071d57ac40f5e2368ab1650ad"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4e76070071d57ac40f5e2368ab1650ad","url":"https://github.com/advisories/GHSA-29pf-2h5f-8g72","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-29pf-2h5f-8g72","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:49:14.191Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4e76070071d57ac40f5e2368ab1650ad"],"technology":"transformers","known_exclusions":[],"conditions_summary":"A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.","public_affected_ranges":["< 5.3.0"]}],"null_published_at":"2026-11-05T19:10:21.456Z","source_updated_at":"2026-07-01T18:00:11.000Z","source_disclosed_at":"2026-05-26T13:30:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:49:14.191Z"}],"next_cursor":null,"snapshot_revision":"42594"}