Hugging Face Transformers contains critical remote code execution vulnerability

CSO Online reports a critical remote code execution vulnerability in Hugging Face's widely used Transformers library that allowed an attacker-controlled model to execute arbitrary code during a standard load, bypassing the trust_remote_code=False safeguard many teams rely on. Tracked as CVE-2026-4372, the flaw was silently patched in Transformers 5.3.0 (released March 3) but had been present in every release since 4.56.0. Per CSO Online, the exploit adds a crafted parameter to a model's remote configuration file so that calling from_pretrained() triggers code execution, and vulnerable versions were still being downloaded 7 to 8 million times per week.

The root weakness is deserialization of untrusted data in the model-loading path: configuration or checkpoint metadata is parsed in a way that can execute attacker-supplied payloads during object reconstruction. Security trackers document a related RCE, CVE-2026-1839, in the library's Trainer class, where the _load_rng_state() routine calls torch.load() without weights_only=True, letting a malicious checkpoint run code; SentinelOne reports a fix in version 5.0.0rc3. The notable shift from earlier malicious-model attacks is that exploitation can occur silently during an ordinary load even when trust_remote_code is disabled.

Transformers is among the most widely used ML libraries, so an RCE in a commonly invoked load path reaches a very large base of open-source and enterprise consumers. Environments that pull and instantiate third-party models automatically, such as model-evaluation pipelines and GPU inference services, are the most exposed, because a single crafted artifact can run code with access to local credentials and secrets.

• •Upgrade Transformers to a patched release (5.3.0 or later) and identify any installs that ran vulnerable 4.56.0-5.2.x versions.
• •Treat model ingestion as a supply-chain touchpoint: pin versions, isolate model loading from secret-bearing environments, and prefer safetensors over pickle-based formats.
• •Track the NVD and OpenCVE entries for CVE-2026-4372 and CVE-2026-1839 for revised severity and affected-version data.