Read the docs
TI-2026-01514 Aliases CVE-2026-1839GHSA-69w3-r845-3855

Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers

Priority HIGH 69CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial huggingface/transformers (huggingface): v5.0.0rc3transformers (PyPI): 5.0.0rc3Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
huggingfacehuggingface/transformersbefore v5.0.0rc3v5.0.0rc3Patch availableCNA
—transformers (PyPI)before 5.0.0rc35.0.0rc3Patch availableGHSA-69w3-r845-3855
  • huggingface/transformers Vendorhuggingface Affected before v5.0.0rc3 Fixed in v5.0.0rc3 Patch available CNA
  • transformers (PyPI) Vendor— Affected before 5.0.0rc3 Fixed in 5.0.0rc3 Patch available GHSA-69w3-r845-3855

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*before 5.0.0Vulnerablehuggingface
cpe:2.3:a:huggingface:transformers:5.0.0:rc0:*:*:*:*:*:*5.0.0 rc0Vulnerablehuggingface
cpe:2.3:a:huggingface:transformers:5.0.0:rc1:*:*:*:*:*:*5.0.0 rc1Vulnerablehuggingface
cpe:2.3:a:huggingface:transformers:5.0.0:rc2:*:*:*:*:*:*5.0.0 rc2Vulnerablehuggingface
  • cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:* Versions before 5.0.0 Vulnerable ·huggingface
  • cpe:2.3:a:huggingface:transformers:5.0.0:rc0:*:*:*:*:*:* Versions 5.0.0 rc0 Vulnerable ·huggingface
  • cpe:2.3:a:huggingface:transformers:5.0.0:rc1:*:*:*:*:*:* Versions 5.0.0 rc1 Vulnerable ·huggingface
  • cpe:2.3:a:huggingface:transformers:5.0.0:rc2:*:*:*:*:*:* Versions 5.0.0 rc2 Vulnerable ·huggingface

Remediation

  • Fix · CNA huggingface/transformers (huggingface) Fixed in v5.0.0rc3
  • Fix · GHSA-69w3-r845-3855 transformers (PyPI) Fixed in 5.0.0rc3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
OpenShift LightspeedAffectedNo fix yet: Fix deferred
Red Hat AI Inference ServerAffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1839
  2. 2026-10-03 Alias added: GHSA-69w3-r845-3855

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-04577 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVSS 3.1CRITICAL 9.6
  • TI-2025-06294 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
  • TI-2025-06027 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
  • TI-2025-02858 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
  • TI-2025-01837 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
  • TI-2024-11793 Regular Expression Denial of Service (ReDoS) in huggingface/transformers CVSS 3.1HIGH 7.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences