CVE-2026-4372: HuggingFace Transformers Remote Code Execution Vulnerability
Summary
CVE-2026-4372: HuggingFace transformers vulnerable to remote code execution. Affects transformers versions < 5.3.0. Fixed in 5.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HuggingFace Transformers library is a popular open-source library used for natural language processing tasks, providing pre-trained models and tools for developers to build AI applications. It allows users to easily load and utilize models for tasks such as text generation, translation, and sentiment analysis. However, a critical vulnerability has been identified that affects all versions prior to 5.3.0, posing significant security risks to users.
Vulnerability Detail
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard AutoModelForCausalLM.from_pretrained() API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the trust_remote_code security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe.
How To Fix
Latest published version: 5.20.2 as of 22 Oct 2026
pip install --upgrade "transformers==5.20.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.3.0
This is the first release that contains the fix.
pip install --upgrade "transformers==5.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid loading models from untrusted sources or repositories until they have updated to the patched version. It is also advisable to review and sanitize any config.json files before loading them.
Conclusion
The HuggingFace Transformers library has a critical remote code execution vulnerability that affects all versions prior to 5.3.0. Users are strongly advised to upgrade to the latest version to mitigate the risk of exploitation. Additionally, temporary workarounds can help reduce exposure until the upgrade is completed.
See every vulnerability recorded for transformers →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
All versions prior to 5.3.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot upgrade immediately, avoid loading models from untrusted sources and review any config.json files for potential threats.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
Related vulnerabilities
Recent vulnerabilities recorded for transformers.
