Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

huggingface/transformers

              main @ c21da1b
            

Fixes

CVEs

CRITICAL

Peak severity

15.8%

Coverage

Highlights

Denial of Service: 18 prior fixes. Scrutinize any change in this area.

src/transformers/modeling_utils.py: most-fixed (7 issues). Treat as high-risk during review.

39 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Unsafe PyTorch checkpoint deserialization (using torch.load with pickle) allows arbitrary code execution during weight loading. The project resolved this by enforcing weights_only=True and migrating to safe formats like safetensors by default.

Remote Code Execution: Dynamic configuration and model files fetched from the Hugging Face Hub can execute arbitrary local code if trust_remote_code=True is bypassed or implicitly enabled. The project implemented strict trust verification and local registration priority to mitigate this risk.

Path Traversal: Unsanitized chat template names and voice preset configurations could allow directory traversal, enabling attackers to write arbitrary files outside target directories during template or preset serialization.