CVE-2026-4372Disclosure(huggingface / transformers)

The security assumption every AI team gets wrong: "As long as trust_remote_code=False is set, we are safe." ❌ We put that to the test. What we uncovered is a critical RCE vulnerability in @huggingface Transformers (CVE-2026-4372) that completely bypasses this control. A thread on how a routine model load turns into complete environment compromise 👇 1/3 🔍 The Exploit & ScaleBy abusing model configuration fields, an attacker can embed a malicious payload inside a configuration file. It executes arbitrary code even with remote code disabled. The affected versions were downloaded over 232M times while live. 2/3 🚨 The RiskSuccessful exploitation means full environment compromise—exposing cloud credentials, API keys, source code, and proprietary datasets. Impacts Transformers versions 4.56.0 through 5.2.x. 3/3 🛡️ Remediation• Upgrade to version 5.3.0 immediately. • Audit previously downloaded model configurations. • Move beyond checkbox security—static ecosystem flags aren't enough. Kudos to the Hugging Face team for the quick patch collaboration. 👇 Full technical breakdown link in the replies!

CVE-2026-4372 was just made public, though we identified and disclosed it to @huggingface back in February. While the HF team were quick to acknowledge and patch (they shipped a fix in just 10 days), it took almost three months from there until the CVE actually landed on NVD. During that gap, users had no real way of knowing they were susceptible to a trivial supply-chain attack that leads to arbitrary code execution just by running a model from HF, bypassing `trust_remote_code=False`. No special flags, no warnings, just a routine `from_pretrained()` call. Given the recent spike in supply chain attacks in the wild, this kind of vulnerability is especially concerning: vulnerable versions of Transformers were downloaded ~232M times, and even today over 23% of weekly installs are still pulling vulnerable versions. Techincal writeup: 🔗 https://pluto.security/blog/unauthenticated-remote-code-execution-in-huggingface-transformers-via-config-injection/

📌 ثغرة حرجة في مكتبة Hugging Face Transformers تمكن من هجمات تنفيذ التعليمات البرمجية عن بعد تم الكشف عن ثغرة أمنية حرجة في مكتبة Hugging Face Transformers، تحمل رقم CVE-2026-4372، تسمح للمهاجمين بتنفيذ التعليمات البرمجية عن بعد (RCE) من خلال ملفات تكوين النماذج الضارة. تعرض هذه الثغرة خطرًا كبيرًا في سلسلة التوريد في أحد أكثر الأطر البرمجية للتعلم الآلي استخدامًا، وتؤثر على المطورين والمؤسسات وأنابيب الذكاء الاصطناعي عالميًا. يُنصح بتحديث المكتبة على الفور وتطبيق الإصلاحات الأمنية اللازمة. 🔗 للمزيد: https://cybersecuritynews.com/?p=151976

AI Security & Cybersecurity Intelligence Brief focused on verification-first strategies for multi-agent systems and SMBs. • It spotlights urgent threats including a critical Hugging Face Transformers RCE (CVE-2026-4372) via malicious configs, Meta AI support chatbot account takeovers, active Check Point VPN auth bypass, and a recent Mastra npm supply-chain backdoor stealing LLM keys and credentials. • Practical SMB takeaways stress immediate dependency upgrades, sandboxing untrusted AI models, credential rotation after incidents, and adopting cryptographic signing plus human oversight to counter agentic AI and supply-chain risks.

CVE-2026-4372: HuggingFace Transformers RCE via config injection. Bypasses trust_remote_code=False silently. 2.2B installs. No warnings. Just loading a model.

CVSS 9.8: HuggingFace transformers' CVE-2026-4372 is under active exploitation, letting attackers execute arbitrary code via config injection. Patch now or assume full compromise. #NerdieNews #CyberSecurity #Vulnerability https://t.co/ABYxZxF3J3

@huggingface We put that to the test. What we uncovered is a critical RCE vulnerability in @huggingface Transformers (CVE-2026-4372) that completely bypasses this control.

CVE-2026-4372: The security assumption every AI team gets wrong: "As long as trustremotecode=False is set, we are safe." ❌ We put that to the test. What we uncovered is a critical RCE vulnerability in @huggingface Transformers (CVE-2026-4372) that completely bypasses this…

Stop blindly loading community AI models into your notebooks. CVE-2026-4372 reveals a critical RCE vulnerability in Hugging Face Transformers. 🚨🔒 A malicious config.json can completely compromise your underlying machine terminal upon import. This is the third major HF supply chain RCE this month. Upgrade to ~5.3.0 and enforce mandatory cryptographic model provenance signing immediately. Lock down your research pods: http://www.mcal.in #HuggingFace #SupplyChainSecurity #DataScience

⚡️You loaded a model from Hugging Face. That alone was enough to run the attacker's code on your machine. CVE-2026-4372 hit Transformers, the most used AI library on the planet. A poisoned config.json could reach into private internal settings through a sloppy setattr() and execute code. Here is the nasty part. It walked straight past trust_remote_code=False, the exact switch people flip on to feel safe. No prompt. No exploit chain. You just open the model. [ WHERE ] Transformers v4.56.0 up to before v5.3.0 [ EXPOSURE ] about 6 months in the wild, Aug 2025 to Mar 2026 [ TRIGGER ] the optional kernels package installed [ FIX ] upgrade to Transformers 5.3.0+ Found by Yotam Perkal at Pluto Security. Every "safe" model you pulled in that window was a maybe. Update now and stop trusting config files.

@Dani__oros @senb0n22a @One1S33175 @krea_ai Looks clean. No deserialization fuckery to sidestep safetensors and no CVE-2026-4372 even though its transformers==4.57.1 Haven't scrutinized every dependency in uv.lock but I probably won't. We are comfortably in the Hanlon's Razor area about the release.

Branch 1: Critical / Breaking Items (Immediate High-Impact Threats) 🔴 Why these matter most right now: Zero-days, active exploitation, and agentic failures with direct supply-chain and verification implications. 1.1 Hugging Face Transformers RCE (CVE-2026-4372) • Description: Critical remote code execution via malicious config.json in model loading (AutoModelForCausalLM.from_pretrained()). Attacker-controlled _attn_implementation_internal field bypasses trust_remote_code=False, triggering unsandboxed Python code execution from a malicious HF Hub repo. Affects versions before 5.3.0 (hundreds of millions of downloads). • Why it matters: Direct AI supply-chain compromise and “Trojan Horse” vector for agentic/multi-agent systems. Enables stealthy persistence, credential theft, or lateral movement in verification/provenance-weak environments. High SMB blast radius via common ML pipelines. • Recommended Actions: • Upgrade to 5.3.0+ immediately • Audit model sources/provenance • Avoid loading untrusted models without isolation/sandboxing • Scan for vulnerable kernels package • Verify with static analysis of configs • Source: Pluto Security / NVD / http://threat-modeling.com
Link: https://pluto.security/blog/unauthenticated-remote-code-execution-in-huggingface-transformers-via-config-injection/ 1.2 Meta AI Support Chatbot Account Takeovers (20k+ Instagram accounts) • Description: Hackers tricked the AI chatbot into resetting/changing emails and passwords on high-profile accounts (e.g., Obama-era White House page) via simple social engineering prompts, bypassing normal verification. Patched by Meta. • Why it matters: Demonstrates agentic AI as an exploitable intermediary for identity/authorization failures. Highlights measurability gaps in AI-human interfaces and correlated risks in multi-agent support systems. Relevant to “liability as a service” if agents act autonomously. • Recommended Actions: • For similar AI support tools: enforce human-in-loop for sensitive actions • Audit agent permissions • Monitor for anomalous prompt patterns • Users: Enable 2FA/MFA everywhere and review linked emails • Source: 404 Media / Krebs on Security / Ars Technica (early June 2026) 1.3 Check Point VPN Auth Bypass (CVE-2026-50751, CVSS 9.3, Active Exploitation) • Description: Logic flaw in deprecated IKEv1 certificate validation allows unauthenticated VPN access (no valid password needed). Actively exploited by Qilin ransomware affiliates. CISA KEV additions and urgent patching urged. • Why it matters: Classic supply-chain/infra risk for SMBs using VPNs. Enables initial access for broader compromises, including agentic systems behind perimeters. Flags correlated failures in legacy configs. • Recommended Actions: • Migrate from IKEv1 • Apply hotfixes immediately (or disable if unpatched) • Audit logs for unauthorized VPN sessions • Restrict management interfaces • CISA BOD 22-01 compliance • Source: Check Point / CISA / Rapid7 (June 8-16, 2026)

Hugging Face Transformers の脆弱性 CVE-2026-4372 が FIX：悪意のモデル読み込みと RCE https://iototsecnews.jp/2026/06/05/hugging-face-transformers-security-flaw-allows-remote-code-execution/ 機械学習モデルを利用する側からは、単なる設定データに見える “config.json” ですが、その処理方法に今回の問題の根本原因があります。ライブラリが内部の仕組みを動的に割り当てる際に、本来はユーザーが触れないはずの内部属性まで、そのまま受け入れてしまったことが、脆弱性 CVE-2026-4372 の引き金となりました。Hugging Face Transformers における脆弱性は、trust_remote_code を無効化している環境でもリモートコード実行が成立する極めて深刻なものです。すでに修正バージョンがリリースされていますので、該当する環境を運用しているチームは、速やかなアップグレードやサンドボックスの徹底などの対策を講じる必要があります。 #CVE20264372 #HuggingFace #Transformers #Vulnerability

Critical Hugging Face Transformers Vulnerability Enables Remote Code Execution Attacks https://ift.tt/GANj0zF A newly disclosed critical vulnerability in the HuggingFace Transformers library, tracked as CVE-2026-4372, allows attackers to achieve remote code execution (RCE) th…

Tracked as CVE-2026-4372, the flaw was silently patched in Transformers 5.3.0 (released March 3) but affected every release since 4.56.0

CVE-2026-4372: Transformers Config Field Turns Model Load into RCE. A model pull now equals third-party package risks! https://zpr.io/cyCYUqFdzVQd https://t.co/UGaT1qCA3E

CVE-2026-4372: Hugging Face Transformers Remote Code Execution Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04n3H_R0

Another month, another critical RCE in the AI model supply chain. CVE-2026-4372 turns a poisoned http://config.json into code execution in Hugging Face Transformers. That is the third one in 30 days. Out here in rural Maine we have a saying: you do not eat an apple you found on the side of the road. Same goes for models you did not build. If your stack loads third-party weights, your real attack surface is the loader, not the model. We are running free Recon pentests for AI companies right now. Find out what is actually exposed before someone else does: https://hubs.li/Q04mJd8_0

Hugging Face Transformers 曝出 RCE 漏洞 CVE-2026-4372，2.32 亿次下载受影响。 一个恶意 config.json 字段就能绕过 trust_remote_code=False 执行任意代码，加载模型 = 执行攻击者代码。 AI supply chain 安全不再是理论问题。生产环境加载第三方模型必须在沙箱中运行，且隔离所有 credentials。

🚨 HuggingFace Transformers RCE — CVE-2026-4372 (7.8) Just loading a model runs attacker code: a malicious config.json executes via from_pretrained(), and trust_remote_code=False does NOT stop it. All versions <5.3.0 affected. Patch to 5.3.0. #AISecurity #infosec