CVE-2025-14928

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Dec 23, 2025, 9:04:48 PM UTC

Updated

May 21, 2026, 3:00:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.34% · Oct 25, 2026

A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious HuBERT model checkpoint, causing arbitrary code execution in the context of the user converting the file. transformers: code execution when converting a malicious HuBERT model checkpoint To exploit this issue, an attacker must convince a user to process a specially crafted HuBERT model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.