TR
Product
transformers
31
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Severity mix
Critical 2High 20Medium 8Low 1
Watch
Add transformers to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5241 | 9.6 | Jun 3 | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers Affected: 5.2.0 |
| CVE-2024-3568 | 9.6 | Apr 10 | The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the… Affected: before 4.38.0 |
| CVE-2024-11394 | 8.8 | Nov 22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2024-11393 | 8.8 | Nov 22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2024-11392 | 8.8 | Nov 22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2023-6730 | 8.8 | Dec 19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 Affected: before 4.36.0 |
| CVE-2026-4372 | 7.8 | May 24 | Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers Affected: before 5.3.0 |
| CVE-2026-1839 | 7.8 | Apr 7 | Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers Affected: before 5.0.0; 5.0.0; 5.0.0; 5.0.0 |
| CVE-2025-14930 | 7.8 | Dec 23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.57.1 |
| CVE-2025-14929 | 7.8 | Dec 23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 5.0.0 |
| CVE-2025-14928 | 7.8 | Dec 23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14927 | 7.8 | Dec 23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14926 | 7.8 | Dec 23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14924 | 7.8 | Dec 23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.55.0 |
| CVE-2025-14921 | 7.8 | Dec 23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.54.1 |
| CVE-2025-14920 | 7.8 | Dec 23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.54.1 |
| CVE-2023-7018 | 7.8 | Dec 20 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 Affected: before 4.36.0 |
| CVE-2025-6921 | 7.5 | Sep 23 | The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer Affected: before 4.53.0 |
| CVE-2025-6638 | 7.5 | Sep 12 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's… Affected: 4.52.4 |
| CVE-2025-3262 | 7.5 | Jul 7 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0 Affected: before 4.51.0 |
| CVE-2025-2099 | 7.5 | May 19 | A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial… Affected: through 4.48.3 |
| CVE-2024-12720 | 7.5 | Mar 20 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py Affected: before 4.48.0 |
| CVE-2025-1194 | 6.5 | Apr 29 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py`… Affected: before 4.50.0 |
| CVE-2026-75104 | 5.5 | Aug 17 | Hugging Face Transformers Path Traversal via Checkpoint Index Affected: through 5.15.0 |
| CVE-2025-6051 | 5.3 | Sep 14 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the… Affected: 4.52.4 |
| CVE-2025-5197 | 5.3 | Aug 6 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()`… Affected: before 4.53.0 |
| CVE-2025-3933 | 5.3 | Jul 11 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()`… Affected: before 4.52.1 |
| CVE-2025-3264 | 5.3 | Jul 7 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within… Affected: 4.49.0 before 4.51.0 |
| CVE-2025-3263 | 5.3 | Jul 7 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function… Affected: 4.49.0 before 4.51.0 |
| CVE-2023-2800 | 4.7 | May 18 | Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0 Affected: before 4.30.0 |
| CVE-2025-3777 | 3.5 | Jul 7 | Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file Affected: before 4.52.1 |
Showing 31