Critical Hugging Face Transformers RCE Flaw (CVE-2024-XXXX) Patched

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-4372, was discovered in the Hugging Face Transformers library.
• The flaw allowed attackers to execute arbitrary Python code by injecting malicious configurations into model files, bypassing existing security controls.
• The vulnerability affected Transformers versions 4.56.0 through 5.2.x when used with the optional kernels package, exposing an estimated 232 million installations over a six-month period.
• Hugging Face released a patch in version 5.3.0, and users are urged to upgrade immediately.

Critical RCE Flaw Patched in Hugging Face Transformers Library

A severe vulnerability, designated CVE-2026-4372, has been identified and patched in the Hugging Face Transformers library, a cornerstone of modern machine learning development. This flaw enabled unauthenticated remote code execution (RCE) through specially crafted model configuration files, posing a significant supply chain risk to AI pipelines globally.

The vulnerability originated from inadequate validation of untrusted data within model configuration files, specifically concerning the _attn_implementation_internal attribute. Threat actors could embed this malicious field into a model’s config.json, causing the library to load and execute arbitrary Python code during the routine model loading process. Critically, this exploit circumvented the trust_remote_code=False security control, which is intended to prevent such actions.

Exploitation Window and Impact

The vulnerable code was introduced in August 2025 and remained exploitable until March 2026, creating an exposure window of approximately six months. During this period, any user loading a compromised model from the Hugging Face Hub via the widely used from_pretrained() function could have been silently compromised.

An attack scenario would typically involve a malicious actor uploading a seemingly benign model to the Hugging Face Hub. This model would contain a doctored config.json file with the nefarious _attn_implementation_internal field, pointing to an attacker-controlled repository. When a victim loads this model, the Transformers library would automatically download and import the external code without proper validation or sandboxing, leading to immediate code execution on the victim’s system.

Successful exploitation could grant attackers access to sensitive information such as AWS credentials, SSH keys, API tokens, and environment variables. Furthermore, it could facilitate the establishment of persistence, enable lateral movement within an organization’s infrastructure, and potentially compromise critical CI/CD pipelines.

The stealthy nature of this attack, which executes during normal model loading without producing warnings or visible indicators, made detection exceptionally challenging. The scale of potential impact is substantial, given that the Transformers library boasts over 2.2 billion installations and processes around 146 million downloads monthly. With more than a million models hosted on the Hugging Face Hub, the attack surface was vast. An estimated 232 million installations were vulnerable during the exposure period, heightening the risk of real-world exploitation.

Researchers at Pluto Security highlighted that this vulnerability underscores a broader systemic issue within machine learning ecosystems: the inherent risk of treating model files and configurations as trusted inputs. Similar vulnerabilities have been observed in other frameworks where “safe” modes fail to prevent code execution due to unaddressed internal pathways.

The Patch and Mitigation

Hugging Face addressed CVE-2026-4372 in version 5.3.0 of the Transformers library. The fix implemented stricter controls by blocking unsafe internal attributes during configuration parsing and enforcing more rigorous checks on kernel loading. Crucially, external code execution now explicitly requires user consent via the trust_remote_code=True setting.

This incident underscores the increasing importance of securing AI supply chains. As machine learning adoption continues to accelerate, threat actors are increasingly targeting model distribution platforms, transforming trusted workflows into high-impact attack vectors.

What You Should Do

• Upgrade Immediately: All organizations and developers utilizing the Hugging Face Transformers library must upgrade to version 5.3.0 or later without delay.
• Audit Existing Models: Conduct a thorough audit of all previously downloaded or deployed models for any signs of compromise or malicious configurations.
• Monitor Network Activity: Implement robust monitoring for suspicious outbound network connections from systems involved in model loading and execution.
• Isolate Environments: Execute machine learning models within isolated and sandboxed environments to minimize the blast radius in case of a successful exploit.
• Exercise Caution: Treat all external model files and configurations as untrusted inputs, regardless of their source, and avoid enabling trust_remote_code unless absolutely necessary and after careful vetting.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.