Transformers vulnerabilities and CVEs
The Beam CVE database tracks 24 security advisories for Transformers: 1 critical, 8 high, 13 medium and 2 low severity. The newest is CVE-2026-80047, published Sep 1, 2026.
Hugging Face's model library. Loading an untrusted model or config file can run code.
Check your version: pip show transformers
- Vulnerabilities tracked
- 24
- Critical
- 1
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 0
All entries, newest first
CVE-2026-80047
Hugging Face Transformers downloads custom generation code before trust consent
high7.8No fixSep 1, 2026CVE-2026-9856
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
high7.1Aug 2, 2026CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
high8.0Jun 3, 2026CVE-2026-4372
HuggingFace transformers vulnerable to remote code execution
high7.8May 26, 2026CVE-2026-1839
HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class
medium6.5Apr 7, 2026CVE-2025-6921
Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
medium5.3Sep 23, 2025CVE-2025-6051
Hugging Face Transformers library has Regular Expression Denial of Service
medium5.3Sep 14, 2025CVE-2025-6638
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
medium5.3Sep 12, 2025CVE-2025-5197
Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
medium5.3Aug 6, 2025CVE-2025-3933
Transformers is vulnerable to ReDoS attack through its DonutProcessor class
medium5.3Jul 11, 2025CVE-2025-3262
Transformers vulnerable to ReDoS attack through its SETTING_RE variable
medium5.3Jul 7, 2025CVE-2025-3263
Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
medium5.3Jul 7, 2025CVE-2025-3264
Transformers vulnerable to ReDoS attack through its get_imports() function
medium5.3Jul 7, 2025CVE-2025-3777
Transformers's Improper Input Validation vulnerability can be exploited through username injection
low3.5Jul 7, 2025CVE-2025-2099
Hugging Face Transformers Regular Expression Denial of Service
medium5.3May 19, 2025CVE-2025-1194
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
medium4.3Apr 29, 2025CVE-2024-12720
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
medium5.3Mar 20, 2025CVE-2024-11392
Deserialization of Untrusted Data in Hugging Face Transformers
high7.5Nov 23, 2024CVE-2024-11393
Deserialization of Untrusted Data in Hugging Face Transformers
high8.8Nov 23, 2024CVE-2024-11394
Deserialization of Untrusted Data in Hugging Face Transformers
high8.8Nov 23, 2024CVE-2024-3568
Transformers Deserialization of Untrusted Data vulnerability
low3.4Apr 10, 2024CVE-2023-7018
transformers has a Deserialization of Untrusted Data vulnerability
high7.8Dec 20, 2023CVE-2023-6730
transformers has a Deserialization of Untrusted Data vulnerability
critical9.0Dec 19, 2023CVE-2023-2800
transformers has Insecure Temporary File
medium4.7May 18, 2023