CVE-2025-14920: Hugging Face Transformers RCE Vulnerability

CVE-2025-14920 Overview

CVE-2025-14920 is a deserialization of untrusted data vulnerability [CWE-502] in Hugging Face Transformers. The flaw resides in the parsing logic for Perceiver model files. Attackers who convince a user to load a crafted model file can execute arbitrary code in the context of the current user. Exploitation requires user interaction, such as opening a malicious model file or visiting a malicious page that triggers model loading. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-25423 and tracked publicly as ZDI-25-1150.

Critical Impact
Successful exploitation grants arbitrary code execution on the host running Hugging Face Transformers, enabling full compromise of machine learning workloads and access to training data, model weights, and credentials in the user context.

Affected Products

Hugging Face Transformers 4.54.1
Python environments loading Perceiver model files via the Transformers library
ML pipelines and notebooks importing untrusted models from public model hubs

Discovery Timeline

2025-12-23 - CVE-2025-14920 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14920

Vulnerability Analysis

The vulnerability exists in the model file parsing routines used by the Perceiver model implementation within Hugging Face Transformers. When Transformers loads a serialized model, the library reconstructs Python objects from the input file. The parsing path does not properly validate user-supplied data before deserialization. An attacker controlling the model file can embed serialized payloads that execute attacker-chosen Python code during reconstruction. Because model loading typically occurs inside data science notebooks, training pipelines, or inference services, the executed code inherits the privileges of the calling process.

Root Cause

The root cause is unsafe deserialization of untrusted data [CWE-502]. The Perceiver loader trusts object metadata and embedded references in the model archive without enforcing an allow-list of safe classes or validating object types before instantiation. Python deserialization formats such as pickle invoke arbitrary callables during object reconstruction, which converts a parsing operation into code execution when the input is attacker-controlled.

Attack Vector

Exploitation requires local access combined with user interaction. The attacker delivers a malicious Perceiver model file through a public model repository, a phishing link, a shared notebook, or a compromised dataset distribution channel. When a developer or automated pipeline loads the model with a standard Transformers call such as from_pretrained(), the embedded payload executes. The resulting code runs with the privileges of the user account hosting the ML workflow, providing access to source code, API keys stored in environment variables, and connected cloud resources.

No verified public proof-of-concept code is available for CVE-2025-14920. Refer to the Zero Day Initiative Advisory ZDI-25-1150 for additional technical context.

Detection Methods for CVE-2025-14920

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running Transformers workloads, particularly sh, bash, powershell.exe, or curl.
Outbound network connections from Jupyter, JupyterLab, or training containers immediately after a from_pretrained() call.
New or modified files in user home directories, SSH key paths, or cloud credential locations such as ~/.aws/credentials shortly after model loading.
Model files downloaded from unverified third-party Hugging Face repositories or untrusted URLs.

Detection Strategies

Inspect loaded model archives for embedded pickle opcodes that reference dangerous callables such as os.system, subprocess.Popen, or __reduce__ payloads.
Monitor Python processes for anomalous module imports following deserialization events using endpoint detection telemetry.
Apply behavioral rules that flag the parent-child relationship of python spawning a shell or network utility on ML workstations and build agents.

Monitoring Recommendations

Centralize Python application logs, container runtime logs, and shell history from data science environments for correlation.
Alert on first-time process execution lineages originating from notebook kernels and inference servers.
Track file integrity on directories containing cached Hugging Face models, such as ~/.cache/huggingface/, to surface unexpected modifications.

How to Mitigate CVE-2025-14920

Immediate Actions Required

Inventory all systems running Hugging Face Transformers version 4.54.1 and earlier and prioritize remediation on shared training infrastructure.
Restrict model loading to vetted internal repositories until a patched version is deployed across affected workloads.
Quarantine any Perceiver model files obtained from untrusted sources and validate provenance before reuse.
Rotate credentials and API tokens exposed to environments where unverified model files have been loaded.

Patch Information

At the time of NVD publication, no fixed version was listed in the available references. Monitor the Zero Day Initiative Advisory ZDI-25-1150 and the official Hugging Face Transformers release notes for an updated build that addresses CVE-2025-14920. Upgrade to the fixed version as soon as it is released.

Workarounds

Prefer the safetensors format over pickle-based serialization when loading models, and set use_safetensors=True where supported.
Execute model loading inside sandboxed containers or virtual machines with no access to production credentials, network egress, or persistent storage.
Enforce signature verification or hash pinning for any model artifact pulled from the Hugging Face Hub or third-party mirrors.
Disable automatic model downloads in CI/CD pipelines and require explicit review of model identifiers and revisions.

bash

# Configuration example: prefer safetensors and pin a trusted revision
export HF_HUB_DISABLE_IMPLICIT_TOKEN=1
export TRANSFORMERS_OFFLINE=0

python -c "from transformers import AutoModel; \
AutoModel.from_pretrained('org/model-name', \
revision='<pinned-commit-sha>', \
use_safetensors=True)"