AI Risk Wire

Cases › security breach › LR-2026-0582

Hugging Face Transformers flaw enables remote code execution

Confirmed Why: 2 independent outlets · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

Severity major
Reported 5 Jun 2026
Developer and model Hugging Face

No source states: loss or records, agent tool, could do, deployer, industry.

Hugging Face Transformers, a machine learning library, loads model configuration files and assigns their values to internal attributes. A flaw in versions 4.56.0 through 5.2.x used with the optional kernels package let a crafted config.json trigger download and import of attacker-referenced code during from_pretrained(), even with trust_remote_code disabled. The vulnerable path was introduced in August 2025 and remained exploitable until a patch in version 5.3.0 in March 2026. A security researcher at Pluto Security discovered the issue, which is tracked as CVE-2026-4372. The sources describe potential credential and environment data theft but do not report a confirmed exploitation. The fix adds a denylist for unsafe internal attributes and requires trust_remote_code=True for external kernel loading.

What happened

1 · What it was doingThe library reads config.json on model load and sets every key-value pair as an attribute.
2 · What went wrongUntrusted configuration data was deserialized unsafely, so an internal field could select code to run.
3 · What it reached or didA matching repository pattern caused the library to download and import the referenced package automatically.
4 · How it was caughtA Pluto Security researcher discovered the flaw and reported it publicly.

What was done

The issue was fixed in Transformers version 5.3.0.

Risks

AI system attacked or breached
Primary23 incidents
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 2 items from the primary sources

What happened, in order

  1. 2025-08 Vulnerable code path introduced.
  2. 2026-03 Flaw patched in version 5.3.0.
Show every field, with its source and grade

The AI system

Developer
Hugging Face
C one secondary source states it

What happened

Earliest source we hold
2026-06-05
D inferred by us from the described behaviour, reason shown
Cause in detail
unsafe deserialization of untrusted configuration data
C one secondary source states it
Who was responsible
the model provider
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown
secondary risks
RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown

LR-2026-0582 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON