Vulnerabilidades em Hugging Face
16 resultadosAnálise Vexday
Hugging Face apresenta 16 vulnerabilidades catalogadas, com 3 classificadas como críticas, porém nenhuma sob ataque ativo conhecido. A fraqueza dominante é deserialização insegura (CWE-502), um padrão típico em plataformas que processam objetos serializados. O risco atual é contido pela baixa atividade exploratória recente (apenas 1 CVE nos últimos 90 dias), recomendando-se atenção contínua ao padrão de deserialização em atualizações.
CVE-2026-25874CRITICALLeRobot Unsafe Deserialization Remote Code Execution via gRPCEPSS 15.5%CVE-2024-11392HIGHHugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 7.1%CVE-2024-11393HIGHHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 2.9%CVE-2024-11394HIGHHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 2.4%CVE-2025-14931CRITICALHugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-14922HIGHHugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14929HIGHHugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14925HIGHHugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14928HIGHHugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14926HIGHHugging Face Transformers SEW convert_config Code Injection Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14927HIGHHugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14921HIGHHugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14920HIGHHugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14930HIGHHugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14924HIGHHugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-68770CRITICALsentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=FalseEPSS —