CVE-2025-14928: (0Day) Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability
Hugging Face Transformers HuBERT convertconfig Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malicious checkpoint.
The specific flaw exists within the convertconfig function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-28253.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14928?
CVE-2025-14928 is a critical vulnerability that allows remote code execution on affected installations of Hugging Face Transformers.
How do I fix CVE-2025-14928?
To fix CVE-2025-14928, update your Hugging Face Transformers library to the latest version that addresses this vulnerability.
What are the attack conditions for CVE-2025-14928?
CVE-2025-14928 requires user interaction to exploit, making it critical that users are aware of suspicious input.
Which versions of Hugging Face Transformers are affected by CVE-2025-14928?
All versions of Hugging Face Transformers prior to the patch addressing CVE-2025-14928 are affected.
What impact can CVE-2025-14928 have on my system?
Exploiting CVE-2025-14928 can allow attackers to execute arbitrary code, potentially compromising the entire system.