CVE-2025-14929
Deserialization RCE in Hugging Face Transformers X-CLIP Checkpoints
Publication date: 2025-12-23
Last updated on: 2025-12-23
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hugging_face | transformers | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a remote code execution flaw in the Hugging Face Transformers library, specifically in the X-CLIP checkpoint conversion feature. It occurs because the software improperly validates checkpoint files during parsing, allowing deserialization of untrusted data. An attacker can exploit this by tricking a user into visiting a malicious webpage or opening a crafted file, which then lets the attacker execute arbitrary code with the same privileges as the current process. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to run arbitrary code on your system with the privileges of the affected application. This can lead to unauthorized actions such as data theft, system compromise, or further malware installation. Exploitation requires user interaction, so the risk depends on user behavior and exposure to malicious content. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid opening untrusted checkpoint files or visiting untrusted webpages that may trigger the deserialization flaw. Ensure that users are aware not to interact with suspicious files or links related to Hugging Face Transformers. Additionally, monitor for updates or patches from Hugging Face and apply them promptly once available. [1]