Advisoriesby Ibis
Transformers security advisories
32 advisories · 12 critical or high in 12 months · latest Sep 1
32 advisories
Hugging Face Transformers downloads custom generation code before trust consentCVE-2026-80047no fix yetTransformers save_pretrained path traversal allows arbitrary file writes through chat template namesCVE-2026-9856fixed in 5.10.0Transformers: code executionCVE-2026-5241fixed in 5.5.0HuggingFace transformers vulnerable to remote code executionCVE-2026-4372fixed in 5.3.0HuggingFace Transformers allows for arbitrary code execution in the `Trainer` classCVE-2026-1839fixed in 5.0.0rc3Transformers: code injectionCVE-2025-14928no fix yetTransformers: unsafe deserializationCVE-2025-14929no fix yetTransformers: unsafe deserializationCVE-2025-14930no fix yetTransformers: unsafe deserializationCVE-2025-14920no fix yetTransformers: unsafe deserializationCVE-2025-14921no fix yetTransformers: unsafe deserializationCVE-2025-14924no fix yetTransformers: code injectionCVE-2025-14926no fix yetTransformers: code injectionCVE-2025-14927no fix yetTransformers: denial of serviceCVE-2025-6921fixed in 4.53.0Hugging Face Transformers library has Regular Expression Denial of ServiceCVE-2025-6051fixed in 4.53.0Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizerCVE-2025-6638fixed in 4.53.0Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197fixed in 4.53.0Transformers is vulnerable to ReDoS attack through its DonutProcessor classCVE-2025-3933fixed in 4.52.1Transformers vulnerable to ReDoS attack through its SETTING_RE variableCVE-2025-3262fixed in 4.51.0Transformers vulnerable to ReDoS attack through its get_imports() functionCVE-2025-3264fixed in 4.51.0Transformers's Improper Input Validation vulnerability can be exploited through username injectionCVE-2025-3777fixed in 4.52.1Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtrackingCVE-2025-3263fixed in 4.51.0Hugging Face Transformers Regular Expression Denial of ServiceCVE-2025-2099fixed in 4.50.0Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-1194fixed in 4.50.0Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2024-12720fixed in 4.48.0Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11394fixed in 4.48.0Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11392fixed in 4.48.0Deserialization of Untrusted Data in Hugging Face TransformersCVE-2024-11393fixed in 4.48.0Transformers Deserialization of Untrusted Data vulnerabilityCVE-2024-3568fixed in 4.38.0transformers has a Deserialization of Untrusted Data vulnerabilityCVE-2023-7018fixed in 4.36.0transformers has a Deserialization of Untrusted Data vulnerabilityCVE-2023-6730fixed in 4.36.0transformers has Insecure Temporary FileCVE-2023-2800fixed in 4.30.0About Transformers
Model definitions for text, vision, audio and multimodal models.
Packages watched: transformers (PyPI).
Hugging Face elsewhere on Ibis: Acquisitions · Paydays · Releases · Repos · Trending