PyPI/transformers CVE-2026-4372: high 7.8, EPSS 0.70%
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.
Action: Upgrade transformers to 5.3.0 or later.
pip install transformers==5.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.3.0 | - |
Fixed versions
| 5.3.0 |
Sources
- osv: PYSEC-2026-2289
- https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f
- https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884
- https://github.com/advisories/GHSA-29pf-2h5f-8g72
CVE-2026-4372 · published · modified · JSON