Vulnerabilities in huggingface

36 results
Vexday analysis

Huggingface registra 30 CVEs na base Vexday, com apenas 2 classificadas como críticas e nenhuma sob ataque ativo no momento. A atividade recente é moderada (6 vulnerabilidades nos últimos 90 dias), sendo CWE-1333 a fraqueza predominante, indicando risco limitado mas que requer monitoramento contínuo.

CVE-2025-5197MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2026-2654MEDIUMhuggingface smolagents LocalPythonExecutor requests.post server-side request forgeryEPSS 0.4%CVE-2025-6051MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.3%CVE-2026-1839MEDIUMArbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformersEPSS 0.3%CVE-2025-3777LOWImproper Input Validation in huggingface/transformersEPSS 0.3%CVE-2026-71281HIGHpeft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA ModulesEPSS 0.3%CVE-2026-65920MEDIUMDiffusers Path Traversal via weight_map Arbitrary File ReadEPSS 0.3%CVE-2026-63086MEDIUMtext-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completionsEPSS 0.3%CVE-2024-3924MEDIUMCode Injection in huggingface/text-generation-inferenceEPSS 0.3%CVE-2025-10772MEDIUMhuggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authenticationEPSS 0.3%CVE-2026-9856HIGHPath Traversal in huggingface/transformersEPSS 0.3%CVE-2023-2800MEDIUMInsecure Temporary File in huggingface/transformersEPSS 0.3%CVE-2026-45804HIGHDiffusers: TOCTOU Trust Remote Code BypassEPSS 0.3%CVE-2025-11844MEDIUMXPath Injection in Hugging Face Smolagents search_item_ctrl_f FunctionEPSS 0.3%CVE-2026-65010MEDIUMDatasets Symlink-following Arbitrary File Write via Extractor.extract()EPSS 0.1%CVE-2026-69112MEDIUMHugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_mapEPSS —