Loading story…
A critical remote code execution flaw in Hugging Face's transformers library allowed attacker-controlled model repositories to run arbitrary code during the standard from_pretrained() loading process, even when trust_remote_code=False was set. The issue was tied to unsafe handling of untrusted model configuration data, including nested configuration resolution in the LightGlue loading path, where values from config.json could override the intended safety setting and trigger execution of attacker-supplied Python modules during model initialization.
Reports said the vulnerability affected transformers versions 4.56.0 through 5.2.x in environments where the kernels package was installed, with version 5.2.0 specifically cited in LightGlue-related exploitation scenarios. Exposed targets included inference servers, research notebooks, CI/CD pipelines, and automated model evaluation systems, where successful compromise could enable theft of cloud credentials, API keys, SSH keys, proprietary datasets, lateral movement, persistence, and backdoor deployment. Hugging Face released a fix in transformers 5.3.0 and urged organizations to upgrade and treat model loading as a code execution surface.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Hugging Face released a fix for the vulnerability in Transformers version 5.3.0 and urged organizations to upgrade immediately. The advisory also warned users to treat model loading as a code execution surface.
A critical remote code execution flaw in Hugging Face Transformers was disclosed, showing that attacker-controlled model configuration data could bypass the intended protection of setting trust_remote_code=False during model loading. The issue was reported as affecting model-loading workflows and enabling arbitrary code execution from malicious model repositories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcecsoonline.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed three high-severity vulnerabilities in Hugging Face’s **Diffusers** library that allow a crafted model repository to bypass the `trust_remote_code` safeguard and execute arbitrary code when a model is loaded. The issues, collectively dubbed **FaceHugger**, affect workflows using `DiffusionPipeline.from_pretrained` with custom pipelines and stem from **time-of-check to time-of-use** flaws in the model download and loading process, where trust validation occurs before later content can be swapped or injected through non-atomic HTTP requests. The disclosure names **`CVE-2026-44827`**, **`CVE-2026-45804`**, and variants grouped under **`CVE-2026-44513`**, and also points to a related trust issue in Hugging Face’s **Transformers** library involving pinned commit hash propagation. Because Diffusers is widely used in production AI pipelines, CI/CD environments, and containerized workloads, successful exploitation could turn a routine model pull into an enterprise initial-access vector. The vulnerabilities were patched in **Diffusers 0.38.0**, and defenders are being urged to upgrade, pin repository revisions, and treat AI model repositories as untrusted executable content.
Aug 11, 2026
A critical vulnerability tracked as **CVE-2026-68770** affects Hugging Face's `sentence-transformers` package and allows **arbitrary code execution** when a model is loaded from a local path, even if applications explicitly set `trust_remote_code=False`. The flaw stems from a logic error in the `import_module_class` helper in `sentence_transformers/util/misc.py`, where an `or os.path.exists(model_name_or_path)` condition accepts existing local filesystem paths and can cause malicious Python code referenced through `modules.json` to run during import. The issue is classified as **CWE-94** and carries a **CVSS 3.1 score of 9.8**, with high impact to confidentiality, integrity, and availability. The bug affects `sentence-transformers` through **version 5.5.1** and creates a significant AI/ML supply-chain risk for organizations that load models from disk or from directories an attacker can influence. Reporting indicates no active exploitation had been confirmed at publication, but maintainers have released a fix, with coverage pointing to **version 5.6.1** as the remediated release. Organizations using local model-loading workflows are being urged to upgrade immediately and tighten controls around model directories, stored artifacts, and any process that imports untrusted model content.
Aug 1, 2026
Researchers reported that malicious machine-learning artifacts hosted on **Hugging Face** can compromise downstream users, highlighting how models, datasets, and related files should be treated as executable supply-chain risk rather than passive content. JFrog detailed cases in which booby-trapped Hugging Face models used unsafe serialization and loading behavior to deliver a **silent backdoor** to data scientists and developers who imported them into local or enterprise environments, while MITRE ATLAS maps the broader threat space with techniques such as `Poison Training Data` and other attacks against ML workflows. Subsequent reporting and security commentary tied those risks to a wider pattern of AI-pipeline compromise, including claims that a malicious dataset exploited flaws in Hugging Face’s processing pipeline to execute code on worker infrastructure, steal cloud credentials, and move into internal clusters. The combined reporting underscores that **features, labels, datasets, checkpoints, and loaders are all part of the attack surface**, and that organizations should harden model-loading paths, restrict egress, eliminate long-lived credentials, isolate workloads, and apply preventive controls before untrusted AI artifacts are executed.
Aug 2, 2026