huggingface/transformers Security Advisories | GitStock

high2026-09-01

CVE-2026-80047-Hugging Face Transformers downloads custom generation code before trust consent

GHSA-x9r9-c232-4q39

high2026-08-02

CVE-2026-9856-Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

GHSA-xrqw-3rrv-vx5w

high2026-06-03

CVE-2026-5241-huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

GHSA-fgcw-684q-jj6r

high2026-05-26

CVE-2026-4372-HuggingFace transformers vulnerable to remote code execution

GHSA-29pf-2h5f-8g72

medium2026-04-07

CVE-2026-1839-HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

GHSA-69w3-r845-3855

medium2025-09-23

CVE-2025-6921-Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

GHSA-4w7r-h757-3r74

medium2025-09-14

CVE-2025-6051-Hugging Face Transformers library has Regular Expression Denial of Service

GHSA-rcv9-qm8p-9p6j

medium2025-09-12

CVE-2025-6638-Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

GHSA-59p9-h35m-wg4g

medium2025-08-06

CVE-2025-5197-Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

GHSA-9356-575x-2w9m

medium2025-07-11

CVE-2025-3933-Transformers is vulnerable to ReDoS attack through its DonutProcessor class

GHSA-37mw-44qp-f5jm

medium2025-07-07

CVE-2025-3263-Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking

GHSA-q2wp-rjmx-x6x9

low2025-07-07

CVE-2025-3777-Transformers's Improper Input Validation vulnerability can be exploited through username injection

GHSA-phhr-52qp-3mj4

medium2025-07-07

CVE-2025-3264-Transformers vulnerable to ReDoS attack through its get_imports() function

GHSA-jjph-296x-mrcr

medium2025-07-07

CVE-2025-3262-Transformers vulnerable to ReDoS attack through its SETTING_RE variable

GHSA-489j-g2vx-39wf

medium2025-05-19

CVE-2025-2099-Hugging Face Transformers Regular Expression Denial of Service

GHSA-qq3j-4f4f-9583

medium2025-04-29

CVE-2025-1194-Transformers Regular Expression Denial of Service (ReDoS) vulnerability

GHSA-fpwr-67px-3qhx

medium2025-03-20

CVE-2024-12720-Transformers Regular Expression Denial of Service (ReDoS) vulnerability

GHSA-6rvg-6v2m-4j46

high2024-11-23

CVE-2024-11393-Deserialization of Untrusted Data in Hugging Face Transformers

GHSA-wrfc-pvp9-mr9g

high2024-11-23

CVE-2024-11392-Deserialization of Untrusted Data in Hugging Face Transformers

GHSA-qxrp-vhvm-j765

high2024-11-23

CVE-2024-11394-Deserialization of Untrusted Data in Hugging Face Transformers

GHSA-hxxf-235m-72v3