PatchSiren cyber security CVE debrief
CVE-2026-4372 huggingface CVE debrief
A critical remote code execution vulnerability exists in the HuggingFace transformers library versions prior to 5.3.0. The vulnerability stems from unfiltered deserialization of configuration attributes in `config.json` files, specifically involving the `_attn_implementation_internal` field. When a victim loads a maliciously crafted model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from an attacker-controlled HuggingFace Hub repository with the victim's full OS privileges. The attack bypasses the `trust_remote_code` security mechanism and is invisible to the victim during standard documented usage. The vulnerability was disclosed via Huntr and patched in commit a7f8e7ff37d87d1a1a0c8cf607971c607741452f. The issue was published to CVE on 2026-05-24 and last modified on 2026-05-26.
- Vendor
- huggingface
- Product
- huggingface/transformers
- CVSS
- HIGH 7.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-24
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-24
- Advisory updated
- 2026-05-26
Who should care
Organizations running HuggingFace transformers for production ML inference, ML platform teams, security teams monitoring AI/ML supply chains, researchers loading community models, and any system automatically processing user-submitted model configurations
Technical summary
The vulnerability exists in the deserialization path of transformers configuration files. The `_attn_implementation_internal` field, intended for internal library use, is not properly sanitized and can be weaponized to specify arbitrary HuggingFace Hub repository IDs. When `AutoModelForCausalLM.from_pretrained()` processes a malicious config.json, it triggers download and execution of attacker-controlled code without requiring `trust_remote_code=True`. The execution occurs with full victim OS privileges due to unsandboxed kernel loading. This represents a supply-chain attack vector where compromised or malicious model repositories can achieve immediate code execution on victim systems through standard ML workflows.
Defensive priority
critical
Recommended defensive actions
- Upgrade HuggingFace transformers library to version 5.3.0 or later immediately
- Audit systems for any models loaded from untrusted sources between 2026-05-24 and patch deployment
- Review model loading pipelines to implement additional validation of config.json files before AutoModel loading
- Consider implementing network egress controls to restrict unexpected HuggingFace Hub repository downloads
- Monitor for anomalous Python process execution originating from transformers library cache directories
Evidence notes
Vulnerability disclosed through Huntr bug bounty platform. Patch commit available in official transformers repository. NVD entry shows status 'Awaiting Analysis' as of source data. CVSS vector indicates local attack vector with user interaction required, though description suggests broader impact through social engineering of model loading.
Official resources
2026-05-24