HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

高 7.8CVE-2026-1839 · GHSA-69w3-r845-3855 · PYSEC-2026-2288 · 07/04/2026 公開 · 26/10/2026 更新

要点

CVE-2026-1839 は transformers, transformers (huggingface) に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 32.2% より高い）。
対処：5.0.0, 5.0.0rc3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
transformers PyPI	`< 5.0.0< 5.0.0rc3`	`5.0.05.0.0rc3`
transformers huggingface	`= 5.0.0< 5.0.0`	`5.0.0`

概要

A vulnerability in the HuggingFace Transformers library, specifically in the Trainer class, allows for arbitrary code execution. The _load_rng_state() method in src/transformers/trainer.py at line 3059 calls torch.load() without the weights_only=True parameter. This issue affects all versions of the library supporting torch>=2.2 when used with PyTorch versions below 2.6, as the safe_globals() context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as rng_state.pth, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.

NVD の説明

A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.