ZeroDay Findings
Sign inSign up

Findings

CVE-2026-1839

A vulnerability in the HuggingFace Transformers library, specifically in the class, allows for arbitrary code execution.

Published Apr 7, 2026 · updated Jun 17, 2026 · huggingface transformers

A vulnerability in the HuggingFace Transformers library, specifically in the class, allows for arbitrary code execution. The method in at line 3059 calls without the parameter. This issue affects all versions of the library supporting when used with PyTorch versions below 2.6, as the context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as , which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 7, 2026 · NIST NVD

    Detected

    A vulnerability in the HuggingFace Transformers library, specifically in the class, allows for arbitrary code execution. The method in at line 3059 calls without the parameter. This issue affects all versions of the library supporting when used with PyTorch versions below 2.6, as the context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a

  2. Jun 17, 2026 · NIST NVD

    Updated

    A vulnerability in the HuggingFace Transformers library, specifically in the class, allows for arbitrary code execution. The method in at line 3059 calls without the parameter. This issue affects all versions of the library supporting when used with PyTorch versions below 2.6, as the context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a

Affected

  • cpe huggingface/transformersversion unspecified
  • cpe huggingface/transformers5.0.0

Sources

  • CVE.orgVulnerability recordCVE-2026-1839

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-1839

    A vulnerability in the HuggingFace Transformers library, specifically in the class, allows for arbitrary code execution. The method in at line 3059 calls without the parameter. This iss

    nvd.nist.gov

References