Read the docs
TI-2024-03662 Aliases CVE-2024-3924GHSA-qq99-p57r-g3v7

Code Injection in huggingface/text-generation-inference

Priority MEDIUM 54CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflow file. The vulnerability arises from the insecure handling of the `github.head_ref` user input, which is used to dynamically construct a command for installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malicious payload as the name, and then opening a pull request to the base repository. Successful exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner. This issue affects versions up to and including v2.0.0 and was fixed in version 2.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00319 24th percentileScored 2026-11-07
Fix Fixed huggingface/text-generation-inference (huggingface): 2.0.0text-generation (PyPI): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
huggingfacehuggingface/text-generation-inferencebefore 2.0.02.0.0Patch availableCNA
—text-generation (PyPI)before 2.0.02.0.0Patch availableGHSA-qq99-p57r-g3v7
  • huggingface/text-generation-inference Vendorhuggingface Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • text-generation (PyPI) Vendor— Affected before 2.0.0 Fixed in 2.0.0 Patch available GHSA-qq99-p57r-g3v7

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:huggingface:text_generation_inference:*:*:*:*:*:*:*:*——huggingface
  • cpe:2.3:a:huggingface:text_generation_inference:*:*:*:*:*:*:*:* Versions — — ·huggingface

Remediation

  • Fix · CNA huggingface/text-generation-inference (huggingface) Fixed in 2.0.0
  • Fix · GHSA-qq99-p57r-g3v7 text-generation (PyPI) Fixed in 2.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3924
  2. 2026-10-03 Alias added: GHSA-qq99-p57r-g3v7

References

Advisory 1

Other 3

  • TI-2026-48351 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False CVSS 4.0CRITICAL 9.3
  • TI-2026-20914 LeRobot Unsafe Deserialization Remote Code Execution via gRPC CVSS 4.0CRITICAL 9.3
  • TI-2026-04577 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVSS 3.1CRITICAL 9.6
  • TI-2025-04589 Sandbox Escape Vulnerability in huggingface/smolagents CVSS 3.1CRITICAL 10.0
  • TI-2026-79938 Pickle deserialization in Hugging Face Datasets allows code execution CVSS 4.0HIGH 8.7
  • TI-2026-32710 Diffusers: None.py Trust Remote Code Bypass CVSS 3.1HIGH 8.8
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences