Vulnerability in transformers (CVE-2026-4372)
Summary
Vulnerability in transformers (CVE-2026-4372). Successful exploitation can lead to full system takeover. Exploitable via _attn_implementation_internal. Mitigation: upgrade to 5.3.0 or later.
Original description
The description as published by the source.
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious config.json file containing the _attn_implementation_internal field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard AutoModelForCausalLM.from_pretrained() API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the trust_remote_code security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-4372 has been found in transformers.
Attackers can target a specific entry point like _attn_implementation_internal over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 7.8/10.
What to do: upgrade transformers to 5.3.0 or later.
If unsure, ask your IT team or search "transformers CVE-2026-4372" on the vendor's site.
CVE-2026-4372 (transformers) — CWE-1066 / CVSS v3 7.8
Attack vector: local / unauthenticated
Attack surface: _attn_implementation_internal / trust_remote_code
Patched: 5.3.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-1066) exists in transformers. Attackers reach the vulnerable code path via _attn_implementation_internal without authentication.
Check the vendor advisory for the affected versions of transformers. Attack surface: _attn_implementation_internal / trust_remote_code.
Severity: High (CVSS 7.8/10). Successful exploitation can lead to full system takeover.
Update to 5.3.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'transformers' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'transformers' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
transformersを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade transformers to 5.3.0ステージング環境で 5.3.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web huntr.com
- web github.com