CVE-2025-14929

Name of the Vulnerable Software and Affected Versions Hugging Face Transformers (affected versions not specified)

Description A flaw exists in Hugging Face Transformers related to the parsing of checkpoints, allowing remote attackers to execute arbitrary code. The issue stems from insufficient validation of user-supplied data, leading to the deserialization of untrusted data. User interaction is required, such as visiting a malicious page or opening a malicious file, to trigger exploitation. The vulnerability was identified as ZDI-CAN-28308.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.