{"schema_version":"0.10.0","id":"LR-2026-0582","record_version":1,"title":"Hugging Face Transformers flaw enables remote code execution","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":55.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"287a90579cb961e63f49a85146fe813a1a92043dc34d04513d916f07c1b95b5f"},"system":{"model_name":null,"model_version":null,"developer":"Hugging Face","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-05","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Hugging Face Transformers, a machine learning library, loads model configuration files and assigns their values to internal attributes. A flaw in versions 4.56.0 through 5.2.x used with the optional kernels package let a crafted config.json trigger download and import of attacker-referenced code during from_pretrained(), even with trust_remote_code disabled. The vulnerable path was introduced in August 2025 and remained exploitable until a patch in version 5.3.0 in March 2026. A security researcher at Pluto Security discovered the issue, which is tracked as CVE-2026-4372. The sources describe potential credential and environment data theft but do not report a confirmed exploitation. The fix adds a denylist for unsafe internal attributes and requires trust_remote_code=True for external kernel loading.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"unsafe deserialization of untrusted configuration data","failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://gbhackers.com/hugging-face-transformers-security-flaw/","publisher":"GBHackers News","date":"2026-06-05","type":"press","title":"Hugging Face Transformers Security Flaw Allows Remote Code Execution - GBHackers News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cybersecuritynews.com/hugging-face-rce-vulnerability/","publisher":"CyberSecurityNews","date":"2026-06-06","type":"press","title":"Critical Hugging Face Transformers Vulnerability Enables Remote Code Execution Attacks - CyberSecurityNews","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.root_cause_detail":"C","event.responsible_party":"C","system.developer":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A critical security flaw in Hugging Face Transformers, tracked as CVE-2026-4372, has exposed millions of machine learning workflows to silent remote code execution (RCE) through a malicious model configuration."}],"event.root_cause_detail":[{"source_index":0,"quote":"At the core of the issue is unsafe deserialization of untrusted configuration data."}],"event.responsible_party":[{"source_index":1,"quote":"HuggingFace addressed the issue in version 5.3.0 by blocking unsafe internal attributes during configuration parsing and enforcing stricter controls on kernel loading."}],"system.developer":[{"source_index":1,"quote":"HuggingFace addressed the issue in version 5.3.0 by blocking unsafe internal attributes during configuration parsing and enforcing stricter controls on kernel loading."}],"impact.severity":[{"source_index":1,"quote":"During the exposure period, an estimated 232 million installations were vulnerable, increasing the likelihood of real-world exploitation."}],"event.summary":[{"source_index":0,"quote":"When a model is loaded, the library processes config.json and dynamically assigns all key-value pairs using Python’s setattr()."},{"source_index":0,"quote":"The vulnerability affects transformer versions 4.56.0 through 5.2.x when used alongside the optional kernels package."},{"source_index":0,"quote":"It remained exploitable for nearly six months until it was patched in version 5.3.0 in March 2026."},{"source_index":0,"quote":"Discovered by Pluto Security researcher Yotam Perkal, the issue allows attackers to execute arbitrary code on a victim’s system simply by tricking them into loading a poisoned model via the standard from_pretrained() API, without requiring trust_remote_code=True or any explicit user interaction."},{"source_index":0,"quote":"Successful exploitation enables attackers to steal sensitive data, including AWS credentials, SSH keys, API tokens, and environment variables."},{"source_index":0,"quote":"The patch introduces a denylist preventing unsafe internal attributes from being set via config files and enforces trust_remote_code=True for external kernel loading."}]},"notes_on_gaps":"No source states the date the flaw occurred, was detected or was disclosed; only publication dates (2026-06-05 and 2026-06-06) appear in the metadata, so those fields are omitted. The sources describe exploitability and a hypothetical attack scenario but do not report a confirmed real-world exploitation, so harm is recorded as potential only. event.agent_involved is set to false as a judgement: no autonomous agent is described. Root cause and trigger are not in the closed lists as clear fits, so they are omitted; root_cause_detail records the stated mechanism. Trust_remote_code being bypassed has no matching control id in the list, so it is not linked. Severity major rests on a stated count of 232 million vulnerable installations, which counts installations rather than parties, a judgement. No model name, deployment context, industry or country is stated. The 'nearly six months' duration is not converted to ISO 8601 because it is approximate. Sources are press reports, not a vendor advisory or government evaluation. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The library reads config.json on model load and sets every key-value pair as an attribute.","quote":"When a model is loaded, the library processes config.json and dynamically assigns all key-value pairs using Python’s setattr().","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Untrusted configuration data was deserialized unsafely, so an internal field could select code to run.","quote":"At the core of the issue is unsafe deserialization of untrusted configuration data.","source_index":0,"grade":"C"},{"step":"reached","text":"A matching repository pattern caused the library to download and import the referenced package automatically.","quote":"If the _attn_implementation_internal value matches a repository pattern like “owner/repo”, the library automatically downloads and imports the corresponding package.","source_index":0,"grade":"C"},{"step":"caught","text":"A Pluto Security researcher discovered the flaw and reported it publicly.","quote":"Discovered by Pluto Security researcher Yotam Perkal, the issue allows attackers to execute arbitrary code on a victim’s system simply by tricking them into loading a poisoned model via the standard from_pretrained() API, without requiring trust_remote_code=True or any explicit user interaction.","source_index":0,"grade":"C"},{"step":"done","text":"The issue was fixed in Transformers version 5.3.0.","quote":"The issue has been fixed in Transformer version 5.3.0.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://gbhackers.com/hugging-face-transformers-security-flaw/","https://cybersecuritynews.com/hugging-face-rce-vulnerability/"]},"analysis":{"sections":{"timeline":[{"text":"Vulnerable code path introduced.","quote":"This vulnerable code path was introduced in August 2025.","source_index":0,"when":"2025-08"},{"text":"Flaw patched in version 5.3.0.","quote":"It remained exploitable for nearly six months until it was patched in version 5.3.0 in March 2026.","source_index":0,"when":"2026-03"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://gbhackers.com/hugging-face-transformers-security-flaw/","https://cybersecuritynews.com/hugging-face-rce-vulnerability/"]}}