CVE-2025-14922
Deserialization RCE in Hugging Face Diffusers CogView4 Checkpoints
Publication date: 2025-12-23
Last updated on: 2025-12-23
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hugging_face | diffusers | 3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a remote code execution flaw in Hugging Face Diffusers, specifically in the parsing of checkpoints. It occurs because the software does not properly validate user-supplied data, leading to deserialization of untrusted data. An attacker can exploit this by tricking a user into visiting a malicious webpage or opening a malicious file, which then allows the attacker to execute arbitrary code within the context of the current process. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to execute arbitrary code on your system with the privileges of the affected application. This can lead to unauthorized actions such as data theft, system compromise, or further attacks within your environment. Exploitation requires user interaction, but once triggered, it can severely impact the confidentiality, integrity, and availability of your system. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid opening untrusted files or visiting untrusted webpages that may contain malicious checkpoints. Ensure that user interaction with untrusted data is minimized. Applying updates or patches from the vendor when available is also recommended. [1]