CVE-2025-14921

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Dec 23, 2025, 9:04:23 PM UTC

Updated

May 21, 2026, 3:00:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.33% · Oct 27, 2026

A flaw was found in the Hugging Face Transformers library. The parsing of model files fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious Transformer-XL model, resulting in arbitrary code execution in the context of the current user processing the file. transformers: code execution when processing a malicious Transformer-XL model file To exploit this issue, an attacker must convince a user to process a specially crafted Transformer-XL model file or visiting a malicious page, limiting the possibility of exploitation. Additionally, model files are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.