Critical RCE vulnerability in Hugging Face Transformers CVE-2026-4372
A critical remote code execution vulnerability in Hugging Face Transformers (CVE-2026-4372) allowed attackers to execute arbitrary code by embedding malicious payloads in model configuration files, bypassing the trust_remote_code=False security setting. The flaw affected versions 4.56.0 through 5.2.x and was downloaded 232 million times before being patched in version 5.3.0.
What happened
Pluto Security Inc. disclosed a critical remote code execution vulnerability in Hugging Face Transformers tracked as CVE-2026-4372. The flaw allowed attackers to execute arbitrary code on a victim's machine by embedding malicious payloads into a model's configuration file.
The vulnerability defeated the trust_remote_code=False security setting, which organizations toggled off to safely vet models pulled from Hugging Face Hub. When a model was loaded using the from_pretrained() command, the attacker-controlled code executed without warnings or prompts.
The vulnerable versions were 4.56.0 through 5.2.x on systems with the kernels package installed. The flaw first appeared in version 4.56.0, released August 29, 2025, and persisted through every subsequent release until the patch.
Reported impact
Pluto estimates the vulnerable versions were downloaded 232 million times during the six months the flaw was live. Transformers is one of the most heavily used AI packages, with over 2.2 billion total downloads and approximately 146 million downloads per month.
Successful exploitation could allow attackers to steal cloud credentials, application programming interface keys, SSH keys, Kubernetes configurations, database credentials, source code and proprietary datasets. Enterprise AI platforms, automated model evaluation pipelines and GPU-enabled environments were among the most exposed targets.
Index analysis
The vulnerability was particularly notable because it required no warnings, prompts or unsafe settings to trigger. Earlier attacks on the AI ecosystem typically depended on tricking users into manually running suspicious scripts, but this flaw could be triggered through a routine download with nothing out of the ordinary on screen.
Governance controls
Pluto reported the issue to Hugging Face in February 2026. Hugging Face fixed the vulnerability in Transformers version 5.3.0, released March 4, 2026, by blocking attacker-controlled configuration values from reaching the vulnerable code path and requiring explicit user consent before loading untrusted external kernels.
Hugging Face recommended upgrading to version 5.3.0 or later immediately and auditing cached model configurations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.