High · published December 24, 2025
⚡ A crafty attacker can execute malicious code just by convincing a user to convert a specially crafted checkpoint in Hugging Face Transformers! 🚀 Think of it like a recipe book that lets anyone add their own secret ingredient without checking if it’s safe — a cook could end up with a dish that’s downright dangerous! 🍽️ If exploited, an attacker could gain control over the system running Hugging Face Transformers, potentially accessing sensitive data or manipulating processes at will. This could lead to a catastrophic loss of integrity and trust in your applications! 🔥
Think of it like a recipe book that lets anyone add their own secret ingredient without checking if it’s safe — a cook could end up with a dish that’s downright dangerous! 🍽️ The vulnerability lies within the `convert_config` function, which fails to properly validate user-supplied strings before executing them as Python code. This oversight allows attackers to run arbitrary code in the context of the current user.
If exploited, an attacker could gain control over the system running Hugging Face Transformers, potentially accessing sensitive data or manipulating processes at will. This could lead to a catastrophic loss of integrity and trust in your applications! 🔥 To mitigate this risk, update Hugging Face Transformers to the latest version as soon as it’s available. Additionally, educate users about the dangers of converting unknown or untrusted checkpoints to prevent exploitation. 🛡️ You’ve got this! Follow these steps and your environment will be much safer in no time! ✨
| Product | Versions | Fixed in |
|---|---|---|
| huggingface/transformers | all versions | — |