CVE-2025-14922: Hugging Face Diffusers RCE Vulnerability

CVE-2025-14922 Overview

CVE-2025-14922 is a deserialization of untrusted data vulnerability in Hugging Face Diffusers affecting the CogView4 checkpoint parser. Attackers can execute arbitrary code in the context of the current process when a user loads a malicious checkpoint file. Exploitation requires user interaction, such as opening a crafted file or visiting a malicious page that triggers the vulnerable code path. The flaw is tracked as [CWE-502] and was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-27424.

Critical Impact
Successful exploitation grants arbitrary code execution within the Python process loading the malicious CogView4 checkpoint, exposing model pipelines, credentials, and connected services.

Affected Products

Hugging Face Diffusers library
CogView4 checkpoint loading pipeline
Python applications and notebooks that import untrusted Diffusers checkpoints

Discovery Timeline

2025-12-23 - CVE-2025-14922 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14922

Vulnerability Analysis

The vulnerability resides in the CogView4 checkpoint parsing logic inside Hugging Face Diffusers. The parser deserializes attacker-controlled data without performing sufficient validation of object types or content. When a user loads a crafted checkpoint, the deserialization routine instantiates objects defined by the attacker, leading to arbitrary code execution.

The issue is classified under [CWE-502], Deserialization of Untrusted Data. Python deserialization formats commonly used for model weights, such as pickle-backed formats, allow constructor side effects during object reconstruction. An attacker who controls the serialized stream can therefore execute arbitrary Python during load.

Execution occurs in the context of the process invoking the Diffusers loader. In typical research and production setups, this process holds access to GPU resources, API tokens, cloud credentials, and local datasets. The EPSS score is 0.315%, indicating limited observed exploitation activity at the time of writing.

Root Cause

The parser lacks proper validation of user-supplied checkpoint data before deserialization. There is no allow-list of permitted classes and no integrity check binding the checkpoint to a trusted publisher. As a result, any object graph encoded in the file is reconstructed without restriction.

Attack Vector

An attacker distributes a malicious CogView4 checkpoint through model hubs, mirrors, archives, or links embedded in web pages. The victim must download and load the file using the vulnerable Diffusers code path. On load, attacker-supplied code runs with the privileges of the current Python process. See the Zero Day Initiative Advisory ZDI-25-1142 for technical details.

// No verified proof-of-concept code is published.
// The vulnerability is triggered by loading a crafted CogView4
// checkpoint that contains attacker-controlled serialized objects.

Detection Methods for CVE-2025-14922

Indicators of Compromise

Unexpected child processes spawned by Python interpreters that load Diffusers checkpoints
Outbound network connections from model-loading processes to untrusted hosts
Checkpoint files downloaded from unverified sources or mirrors outside the official Hugging Face Hub
New or modified Python files in site-packages or user directories shortly after a checkpoint load

Detection Strategies

Monitor for pickle, torch.load, or Diffusers loader calls operating on files from untrusted origins
Flag Python processes that execute shell utilities such as sh, bash, curl, or wget after importing Diffusers
Inspect checkpoint files for embedded __reduce__, os.system, or subprocess references prior to loading

Monitoring Recommendations

Log and alert on file writes to credential stores and SSH directories from ML workloads
Capture process lineage for Jupyter, Python, and container runtimes used by data science teams
Correlate outbound DNS and HTTP traffic from training nodes against a baseline of expected model registries

How to Mitigate CVE-2025-14922

Immediate Actions Required

Update Hugging Face Diffusers to the latest fixed release once published by the maintainers
Restrict checkpoint loading to files retrieved from verified, signed sources
Run model-loading workloads in isolated containers or virtual machines with minimal credentials

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-25-1142 for vendor coordination status and to the Hugging Face Diffusers repository for the corresponding fix commit and release notes.

Workarounds

Avoid loading CogView4 checkpoints from untrusted publishers, forums, or third-party mirrors
Prefer safetensors-formatted weights over pickle-based checkpoint formats whenever available
Apply seccomp, AppArmor, or SELinux profiles that block process and network operations during checkpoint load

bash

# Example: load checkpoints inside an isolated, network-restricted container
docker run --rm \
  --network=none \
  --read-only \
  --tmpfs /tmp \
  -v /models:/models:ro \
  python:3.11-slim \
  python -c "from diffusers import DiffusionPipeline; \
             DiffusionPipeline.from_pretrained('/models/cogview4')"