PyPI/transformers CVE-2026-1839: medium 6.5, EPSS 0.38%

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

Action: Upgrade transformers to 5.0.0rc3 or later.

pip install transformers==5.0.0rc3

Affected

Fixed versions

Sources

• osv: GHSA-69w3-r845-3855
• https://nvd.nist.gov/vuln/detail/CVE-2026-1839
• https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396
• https://github.com/huggingface/transformers
• https://github.com/huggingface/transformers/releases/tag/v5.0.0rc3
• https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485

CVE-2026-1839 · published 2026-04-07T06:30:28Z · modified 2026-09-10T03:50:43.300048881Z · JSON