CVE-2025-14921: Hugging Face Transformers RCE Vulnerability

CVE-2025-14921 Overview

CVE-2025-14921 is a deserialization of untrusted data vulnerability [CWE-502] in Hugging Face Transformers. The flaw resides in the parsing logic for Transformer-XL model files. An attacker who convinces a user to load a crafted model file executes arbitrary code in the context of the current user.

Exploitation requires user interaction. The target must open a malicious model file or visit a page that triggers model loading. The issue was reported through the Zero Day Initiative as ZDI-CAN-25424 and tracked publicly as ZDI-25-1149.

Critical Impact
Loading a malicious Transformer-XL model yields arbitrary code execution with the privileges of the user running the transformers library, enabling full compromise of machine learning workstations and pipelines.

Affected Products

Hugging Face Transformers version 4.54.1
Python environments that import transformers and load Transformer-XL checkpoints
ML pipelines and notebooks that auto-download models from untrusted repositories

Discovery Timeline

2025-12-23 - CVE-2025-14921 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14921

Vulnerability Analysis

The vulnerability exists in how transformers parses Transformer-XL model files. The library deserializes attacker-controlled data from the model archive without validating its contents. Python's serialization formats, including pickle, allow embedded objects to invoke arbitrary callables during reconstruction.

When a user loads a crafted model with helpers such as from_pretrained, the parsing routine reconstructs Python objects from the archive. A malicious payload runs immediately as part of object instantiation. The attacker therefore gains code execution in the same process that imported transformers.

Because Transformer-XL checkpoints are commonly distributed through the Hugging Face Hub and mirrored across community repositories, a single poisoned upload can reach many downstream consumers. Automated training and inference systems that pull models by name are equally exposed.

Root Cause

The root cause is the lack of proper validation of user-supplied data prior to deserialization [CWE-502]. The model parser trusts the structure and class references inside the checkpoint, allowing attacker-supplied objects to execute code during reconstruction.

Attack Vector

The attack vector is local and requires user interaction. An attacker publishes a malicious Transformer-XL model file or hosts it behind a URL. When a victim downloads the model and invokes the loading API in transformers, the embedded payload runs with the privileges of the current user. See the Zero Day Initiative Advisory ZDI-25-1149 for additional technical context.

No verified proof-of-concept code is published. The vulnerability
manifests during model deserialization in the Transformer-XL parser.
Refer to ZDI-25-1149 for vendor-coordinated technical details.

Detection Methods for CVE-2025-14921

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running transformers, such as shells, curl, wget, or powershell
Outbound network connections initiated immediately after a model load operation
New persistence artifacts, cron jobs, or scheduled tasks created by ML training accounts
Model files downloaded from unverified Hugging Face repositories or mirrors

Detection Strategies

Monitor process lineage where the parent is python or jupyter and the child is a command interpreter or network utility
Hash and inventory all model files loaded by data science workloads, then compare against allow-listed publishers
Inspect Python audit hooks (sys.addaudithook) for pickle.find_class and exec events triggered during model deserialization
Alert on transformers package versions equal to or below 4.54.1 discovered through software bill of materials scans

Monitoring Recommendations

Log all invocations of from_pretrained and capture the model identifier and source URL
Forward endpoint process and network telemetry from ML workstations and training clusters to a central analytics platform
Track egress traffic from GPU hosts, which typically have predictable destinations and should not contact arbitrary hosts

How to Mitigate CVE-2025-14921

Immediate Actions Required

Inventory every system running transformers version 4.54.1 or earlier and prioritize upgrade once a fixed release is published
Restrict model downloads to vetted, internally mirrored repositories and block direct access to the public Hugging Face Hub from production training nodes
Run model loading workloads under low-privilege service accounts isolated from source code, secrets, and identity material
Quarantine and re-verify any Transformer-XL checkpoints obtained from untrusted sources

Patch Information

No vendor patch URL is listed in the advisory at the time of publication. Track the Zero Day Initiative Advisory ZDI-25-1149 and the huggingface/transformers project release notes for a fixed version, then upgrade promptly once available.

Workarounds

Avoid loading Transformer-XL model checkpoints from any source you do not control until a fix is released
Prefer the safetensors format for model weights where supported, since it does not execute embedded code during loading
Execute model loading inside a sandbox such as a hardened container, gVisor, or a dedicated virtual machine with no outbound network access
Use Python audit hooks to deny pickle.find_class calls that resolve to unexpected modules during model deserialization

bash

# Pin transformers to a vetted internal mirror and disable hub fetches
export HF_HUB_OFFLINE=1
export TRANSFORMERS_OFFLINE=1
pip install --index-url https://internal.mirror.example/pypi/simple/ \
    "transformers!=4.54.1"

# Run model loaders under a restricted user with no network egress
sudo -u ml-loader firejail --net=none python load_model.py