CVE-2025-14926: (0Day) Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability
Hugging Face Transformers SEW convertconfig Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.
The specific flaw exists within the convertconfig function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28251.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14926?
CVE-2025-14926 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-14926?
To fix CVE-2025-14926, update to the latest version of Hugging Face Transformers that addresses this vulnerability.
What platforms are affected by CVE-2025-14926?
CVE-2025-14926 affects installations of Hugging Face Transformers on any platform where the vulnerable versions are used.
What type of attack does CVE-2025-14926 facilitate?
CVE-2025-14926 facilitates a remote code execution attack requiring user interaction to exploit.
Is user interaction necessary for exploiting CVE-2025-14926?
Yes, user interaction is required to exploit CVE-2025-14926.