TR
Product
transformers
31
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Severity mix
Critical 2High 20Medium 8Low 1
Watch
Add transformers to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-11394 | 8.8 | Nov 22 | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2024-11393 | 8.8 | Nov 22 | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2024-11392 | 8.8 | Nov 22 | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: before 4.48.0 |
| CVE-2023-6730 | 8.8 | Dec 19 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 Affected: before 4.36.0 |
| CVE-2026-4372 | 7.8 | May 24 | Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers Affected: before 5.3.0 |
| CVE-2026-1839 | 7.8 | Apr 7 | Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers Affected: before 5.0.0; 5.0.0; 5.0.0; 5.0.0 |
| CVE-2025-14930 | 7.8 | Dec 23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.57.1 |
| CVE-2025-14929 | 7.8 | Dec 23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 5.0.0 |
| CVE-2025-14928 | 7.8 | Dec 23 | Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14927 | 7.8 | Dec 23 | Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14926 | 7.8 | Dec 23 | Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability Affected: 4.57.0 |
| CVE-2025-14924 | 7.8 | Dec 23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.55.0 |
| CVE-2025-14921 | 7.8 | Dec 23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.54.1 |
| CVE-2025-14920 | 7.8 | Dec 23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 4.54.1 |
| CVE-2023-7018 | 7.8 | Dec 20 | Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36 Affected: before 4.36.0 |
| CVE-2025-6921 | 7.5 | Sep 23 | The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer Affected: before 4.53.0 |
| CVE-2025-6638 | 7.5 | Sep 12 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's… Affected: 4.52.4 |
| CVE-2025-3262 | 7.5 | Jul 7 | A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0 Affected: before 4.51.0 |
| CVE-2025-2099 | 7.5 | May 19 | A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial… Affected: through 4.48.3 |
| CVE-2024-12720 | 7.5 | Mar 20 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py Affected: before 4.48.0 |
Showing 20