CVE-2026-4372

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4372", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2026-03-18T10:04:09.683Z", "datePublished": "2026-05-24T13:40:40.995Z", "dateUpdated": "2026-05-26T15:21:02.376Z"}, "containers": {"cna": {"title": "Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-05-24T13:40:40.995Z"}, "descriptions": [{"lang": "en", "value": "A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue."}], "affected": [{"vendor": "huggingface", "product": "huggingface/transformers", "versions": [{"version": "unspecified", "lessThan": "5.3.0", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884"}, {"url": "https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-1066 Missing Serialization Control Element", "cweId": "CWE-1066"}]}], "source": {"advisory": "1f693a6e-6836-4b8b-a0bd-ca036fba8884", "discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T15:08:29.632933Z", "id": "CVE-2026-4372", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:21:02.376Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4372", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T15:08:29.632933Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:20:57.850Z"}}], "cna": {"title": "Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers", "source": {"advisory": "1f693a6e-6836-4b8b-a0bd-ca036fba8884", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "huggingface", "product": "huggingface/transformers", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "5.3.0", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884"}, {"url": "https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f"}], "descriptions": [{"lang": "en", "value": "A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1066", "description": "CWE-1066 Missing Serialization Control Element"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-05-24T13:40:40.995Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4372", "state": "PUBLISHED", "dateUpdated": "2026-05-26T15:21:02.376Z", "dateReserved": "2026-03-18T10:04:09.683Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2026-05-24T13:40:40.995Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "huggingface/transformers", "vendor": "huggingface", "versions": [{"lessThan": "5.3.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:huggingface:transformers:*:*:*:*:*:*:*:*", "matchCriteriaId": "DCF55C52-9279-4B31-A8E9-004C31DA635F", "versionEndExcluding": "5.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue."}, {"lang": "es", "value": "Existe una vulnerabilidad cr\u00edtica de ejecuci\u00f3n remota de c\u00f3digo en todas las versiones de la biblioteca HuggingFace transformers anteriores a la versi\u00f3n 5.3.0. La vulnerabilidad permite a un atacante crear un archivo 'config.json' malicioso que contiene el campo '_attn_implementation_internal' configurado con un ID de repositorio de HuggingFace Hub controlado por el atacante. Cuando una v\u00edctima carga este modelo utilizando la API est\u00e1ndar 'AutoModelForCausalLM.from_pretrained()', la biblioteca descarga y ejecuta c\u00f3digo Python arbitrario del repositorio del atacante con los privilegios completos del sistema operativo de la v\u00edctima. Este problema surge debido a la deserializaci\u00f3n no filtrada de atributos de configuraci\u00f3n, la sanitizaci\u00f3n insuficiente de campos internos y la ejecuci\u00f3n sin sandboxing de kernels descargados. La vulnerabilidad elude el mecanismo de seguridad 'trust_remote_code', es invisible para la v\u00edctima y explota el patr\u00f3n de uso est\u00e1ndar documentado, lo que la hace particularmente grave. Se aconseja a los usuarios actualizar a la versi\u00f3n 5.3.0 o posterior para mitigar este problema."}], "id": "CVE-2026-4372", "lastModified": "2026-07-23T17:10:00.123", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security@huntr.dev", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4372", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T15:08:29.632933Z", "version": "2.0.3"}}]}, "published": "2026-05-24T14:16:16.917", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1066"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.3.0)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "matching", "scores": [{"score": 80.0, "source": "matching"}]}, "original": {"product": "huggingface/transformers", "source": "cna", "vendor": "huggingface"}, "product": "transformers", "vendor": "huggingface"}], "created": "2026-05-24T16:00:03.498204+00:00", "updated": "2026-06-04T20:00:15.495648+00:00", "vendors": ["huggingface", "huggingface$PRODUCT$transformers"]}