CriticalVulnerability
CVE-2024-3568: huggingface/transformers arbitrary code execution via untrusted deserialization
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-3568
- Published
- Record updated
- Affected
- transformers < 4.38.0
- Fixed in
- 4.38.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 2.1%
Summary
CVE-2024-3568 affects the huggingface/transformers library through unsafe deserialization in the load_repo_checkpoint() function of the TFPreTrainedModel() class. The function calls pickle.load() on data from potentially untrusted sources, so a crafted serialized payload can execute arbitrary code when a victim loads a seemingly harmless checkpoint during normal training.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
- HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
- MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database
- HighCVE-2026-58474: whichllm code injection in run and snippet commands via GGUF filenamesSame vendor · NVD/CVE Database
- HighCVE-2026-79784: Vocos class instantiation from configuration via from_pretrainedSame vendor · NVD/CVE Database