Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability

An attacker can exploit this vulnerability by crafting a malicious checkpoint file and enticing a user to convert it using Hugging Face Transformers. Successful exploitation allows the attacker to execute arbitrary code on the affected system with the privileges of the user running the Transformers library. This could lead to complete system compromise, data exfiltration, or installation of malware. The requirement for user interaction (converting the checkpoint) limits the immediate blast radius, but widespread use of Transformers in machine learning pipelines increases the potential for exploitation across numerous environments. This vulnerability shares similarities with other code injection flaws where unchecked user input is used in code execution contexts.

Machine learning engineers and data scientists using Hugging Face Transformers in their workflows are at risk. Specifically, those using version 4.57.0 and deploying models in environments where they process user-provided checkpoint files are particularly vulnerable. Shared hosting environments where multiple users can upload and process checkpoints also present a heightened risk.

• python / transformers:

import os
import subprocess
# Check for vulnerable version
result = subprocess.run(['pip', 'show', 'transformers'], capture_output=True, text=True)
if 'Version: 4.57.0' in result.stdout:
    print('Vulnerable version detected!')

• python / transformers: Monitor for processes executing Transformers with unusual command-line arguments related to checkpoint conversion. • generic web: Monitor web server access logs for requests to endpoints that trigger the convert_config function with potentially malicious checkpoint files.

1. 2025-12-23Disclosure

   disclosure

1. Reserviert2025-12-18
2. Veröffentlicht2025-12-23
3. Geändert2025-12-26
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade Hugging Face Transformers to version 4.57.1 or later. If upgrading is not immediately feasible, consider implementing input validation on checkpoint files before processing them. Restrict access to the convert_config function and the directories where checkpoints are stored. Employ a Web Application Firewall (WAF) to filter potentially malicious checkpoint files based on known patterns or signatures. Monitor system logs for unusual activity related to checkpoint conversion processes. After upgrading, confirm the fix by attempting to convert a known malicious checkpoint (in a safe, isolated environment) and verifying that the code execution is prevented.