huggingface

Top products

The 15 most recently published vulnerabilities affecting huggingface.

• CVE-2026-71281peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules8.8Aug 5, 2026
• CVE-2026-9856Path Traversal in huggingface/transformers7.1Aug 2, 2026
• CVE-2026-66007Datasets Path Traversal via Unsanitized file_name Metadata6.5Jul 24, 2026
• CVE-2026-65010Datasets Symlink-following Arbitrary File Write via Extractor.extract()6.6Jul 23, 2026
• CVE-2026-65920Diffusers Path Traversal via weight_map Arbitrary File Read4.3Jul 23, 2026
• CVE-2026-63086text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions8.6Jul 16, 2026
• CVE-2026-45804Diffusers: TOCTOU Trust Remote Code Bypass7.5Jul 15, 2026
• CVE-2026-5241Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers9.6Jun 3, 2026
• CVE-2026-4372Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers7.8May 24, 2026
• CVE-2026-44827Diffusers: None.py Trust Remote Code Bypass8.8May 14, 2026
• CVE-2026-44513Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components8.8May 14, 2026
• CVE-2026-25874LeRobot Unsafe Deserialization Remote Code Execution via gRPC9.8Apr 23, 2026
• CVE-2026-1839Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers7.8Apr 7, 2026
• CVE-2026-4963huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection6.3Mar 27, 2026
• CVE-2026-2654huggingface smolagents LocalPythonExecutor requests.post server-side request forgery6.3Feb 18, 2026