GHSA-69w3-r845-3855 CVE-2026-1839 PYSEC-2026-2288

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

High PyPI

Severity: 6.5 / 10; High · CVSS 3.0
Exploit chance (EPSS): 0.38%; Chance of exploitation in the next 30 days. Higher than 32.22% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-502 Deserialization of Untrusted Data
Fix: 5.0.0rc3; Upgrade transformers to this version or later

Description

A vulnerability in the HuggingFace Transformers library, specifically in the Trainer class, allows for arbitrary code execution. The _load_rng_state() method in src/transformers/trainer.py at line 3059 calls torch.load() without the weights_only=True parameter. This issue affects all versions of the library supporting torch>=2.2 when used with PyTorch versions below 2.6, as the safe_globals() context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as rng_state.pth, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.

Affected versions

PyPI

Package	Vulnerable	Fixed in
transformers	`< 5.0.0rc3`	`5.0.0rc3`
transformers	`< 5.0.0`	`5.0.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

transformers PyPI → `5.0.0rc3`

pip

pip install --upgrade "transformers>=5.0.0rc3"

poetry

poetry add "transformers>=5.0.0rc3"

uv

uv add "transformers>=5.0.0rc3"

Severity breakdown

CVSS 3.0 6.5

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H

Attack vector: Local
Attack complexity: High
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: Low
Availability: High

Weakness

CWE-502: Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

How to prevent it

Architecture and Design, Implementation: If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation: When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Implementation: Explicitly define a final object() to prevent deserialization.
Architecture and Design, Implementation: Make fields transient to protect them from deserialization. An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
Implementation: Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
Architecture and Design, Implementation: Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

References

Advisories

Packages

github.com/huggingface/transformers

Timeline

Apr 7, 2026 Published
Oct 26, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-x9r9-c232-4q39 Hugging Face Transformers downloads custom generation code before trust consent	High	Also affects transformers
GHSA-xrqw-3rrv-vx5w Transformers save_pretrained path traversal allows arbitrary file writes through chat template names	High	Also affects transformers
GHSA-fgcw-684q-jj6r huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path	Critical	Also affects transformers
GHSA-29pf-2h5f-8g72 HuggingFace transformers vulnerable to remote code execution	High	Also affects transformers
PYSEC-2025-218 Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.	High	Also affects transformers
PYSEC-2025-217 Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability.	High	Also affects transformers
PYSEC-2025-216 Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability.	High	Also affects transformers
PYSEC-2025-215 Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability.	High	Also affects transformers

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor