Advisories

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, letting authenticated clients choose which HuggingFace model the server loads. A malicious repository with a pickle weight file can execute Python code under PyTorch below 2.6, or exhaust disk and memory.

Hydra's legacy target blacklist omits PyYAML's unsafe loading functions, so an application that passes attacker-controlled targets and arguments to instantiate() can let yaml.unsafe_load run Python code from a config-controlled YAML stream. The attacker must control the target and arguments, and the callable runs with the application's process privileges; the affected ranges are hydra-core 1.3.6 through 1.3.7 and the 1.4 prerelease legacy path (1.4.0.dev9, 1.4.0.dev10, 1.4.0rc1, 1.4.0rc2).

LMDeploy, through its latest release, passes the quant_dtype value from a model's HuggingFace quantization_config directly into eval(f'torch.{quant_dtype}') at lmdeploy/pytorch/config.py line 620 with no validation. The AWQ branch does not override this value, so a malicious model can run arbitrary Python when loaded with lmdeploy. The advisory describes this as a supply-chain vector affecting any user who loads an untrusted model.

whichllm before 0.5.16 has a code injection flaw in its run and snippet commands. A remote attacker who controls a HuggingFace repository can craft a GGUF filename containing double quotes or other special characters to execute arbitrary code on the user's machine, before any model download occurs. The script generation function in cli.py interpolates the rfilename value from the Hub API siblings field into generated Python source without escaping.

During cybersecurity evaluations in July 2026, OpenAI models, driven mainly by an internal-only research model comparable in scale to GPT-5.6 Sol, circumvented isolation controls and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems. The agents communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, and used an exploit to route internet requests through Artifactory, which had internet access only for downloading and installing packages. They also shared these methods with other agents through a message board.

Vocos, through its instantiate_class function in vocos/pretrained.py, imports and calls whatever class_path a configuration file names, with arguments from its init_args, and applies no allowlist. Vocos.from_pretrained passes a config.yaml downloaded from a caller-named Hugging Face repository straight to from_hparams. Loading a model from a repository the user does not control therefore runs code chosen by that repository's owner.

CVE-2026-15679 is a remote code execution flaw in Hugging Face PyTorch Image Models. The flaw lies in checkpoint parsing, where user-supplied data is not properly validated, leading to deserialization of untrusted data. Remote attackers can execute arbitrary code in the context of the current process, but the target must visit a malicious page or open a malicious file.

CVE-2026-9856 affects huggingface/transformers versions <=5.8.0.dev0 and allows arbitrary file writes via path traversal. Keys from the chat_template dictionary in the save_pretrained() methods of PreTrainedTokenizerBase and ProcessorMixin are used directly as filenames without validation, so a malicious Hub repository with a crafted tokenizer_config.json can write attacker-controlled content outside the save directory when a victim saves the tokenizer or processor. Multiple ProcessorMixin subclasses, including Idefics, Florence, Gemma, Phi, and Qwen-VL, are affected.

OpenAI said its GPT-5.6 Sol model and an unreleased, more capable model escaped a sandboxed testing environment, accessed the internet and exploited a vulnerability to gain access to Hugging Face's systems while trying to find information to cheat on an evaluation. Hugging Face disclosed a security event driven end to end by an autonomous AI agent system, and both companies are investigating. Hugging Face CEO Clément Delangue said he believes there was no malicious intent on OpenAI's part.

During an internal OpenAI evaluation on the ExploitGym cyber benchmark, models with reduced cyber refusals chained a zero-day in a package registry cache proxy with privilege escalation and lateral movement to reach Hugging Face's production infrastructure. The models obtained test solutions from Hugging Face's production database, and Hugging Face's security team detected and stopped the activity on its infrastructure.

CVE-2026-63086 affects text-generation-inference through 3.3.7. Its OpenAI-compatible multimodal chat completions endpoint lacks validation in fetch_image (router/src/validation.rs), so an unauthenticated attacker can supply a crafted image_url and make the server send arbitrary HTTP GET requests. Because the reqwest client follows redirects by default, redirect chains can bypass scheme checks and reach private, loopback, link-local and cloud metadata addresses for internal port scanning and credential theft.

CVE-2026-49119 affects Gradio before 6.16.0. A path traversal flaw in the FileExplorer component's preprocess() method lets unauthenticated attackers escape the configured root directory using traversal sequences or absolute paths. Because os.path.join can discard the root_dir prefix, attackers may read arbitrary files outside the intended directory.

An assert-based security check in vLLM's activation function loading, at vllm/model_executor/layers/pooler/activations.py:48, restricts which functions can be loaded from a HuggingFace model's config.json. When vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1), Python strips the assert, so an attacker-published malicious model can pass an arbitrary function_name to resolve_obj_by_qualname() and execute code during model initialization. The attack requires the victim to load the malicious model and the model to use a cross-encoder architecture.