Deserialization of untrusted data in huggingface Transformers
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-502.
Summary
Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25423.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| huggingface | Transformers | 9c8bd3fc1befe54f3efb9f385561eef49f060a70 | — | No fix listed | CNA |
- Transformers Vendorhuggingface Affected 9c8bd3fc1befe54f3efb9f385561eef49f060a70 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:huggingface:transformers:4.54.1:*:*:*:*:*:*:* | 4.54.1 | Vulnerable | huggingface |
- cpe:2.3:a:huggingface:transformers:4.54.1:*:*:*:*:*:*:* Versions 4.54.1 Vulnerable ·huggingface
Remediation
Red Hat 4 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:42644 Released 2026-07-21 · Red Hat rating ImportantRHOAI 2.25.9 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
- RHSA-2026:3782 Released 2026-03-04 · Red Hat rating CriticalRHOAI 2.25.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
Show 1 more Red Hat advisories
- RHSA-2026:3713 Released 2026-03-04 · Red Hat rating CriticalRHOAI 3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Lightspeed | Affected | No fix planned: Will not fix |
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:3782, RHSA-2026:42644, RHSA-2026:87410 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:3713 |
Not affected: 5 products
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14920
- 2026-10-03 Alias added: GHSA-7hhx-w23w-fg5v
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat
References
Advisory 1
More huggingface Transformers vulnerabilities
- TI-2026-04577 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVSS 3.1CRITICAL 9.6
- TI-2025-06294 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
- TI-2025-06027 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
- TI-2025-02858 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
- TI-2025-01837 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
- TI-2024-11793 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
Sources
- CVE-2025-14920 · CVE Program
- CVE-2025-14920 · NVD
- FIRST EPSS
- GHSA-7hhx-w23w-fg5v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-14920 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences