CVE-2026-4372: Transformers config.json RCE bypasses

CISO Take

A newly disclosed flaw in every version of Hugging Face's transformers library prior to 5.3.0 lets an attacker smuggle arbitrary code execution through a model's config.json — abusing an internal `_attn_implementation_internal` field to point at attacker-controlled code on the Hub, and critically, this bypasses the trust_remote_code flag most teams rely on as their safety gate. Given that transformers sits underneath 8,333 downstream packages and is the default loader across countless RAG, fine-tuning, and agent pipelines, any model load — even one a developer believes is 'safe' because trust_remote_code is off — can hand an attacker full OS-level privileges invisibly. There's no public exploit, no CISA KEV listing, and EPSS sits at a modest 0.48% (top 62nd percentile) with an SSVC verdict of TRACK, so this isn't being mass-exploited today — but the technique itself requires no advanced tooling, just a poisoned Hub repo and a victim who calls AutoModelForCausalLM.from_pretrained(). Patch to transformers 5.3.0+ immediately across every environment that loads Hub models, and in the interim restrict model loading to vetted, pinned repos and sandbox the load process so a bypassed trust_remote_code check can't translate into host compromise.

Sources: NVD GitHub Advisory EPSS OpenSSF ATLAS huntr.com

What is the risk?

High severity (CVSS 7.8, full confidentiality/integrity/availability compromise) combined with an unusually large blast radius: transformers underlies 8,333 downstream dependents plus the broader Hugging Face model ecosystem, meaning a single poisoned repo can compromise any pipeline that loads models via AutoModelForCausalLM. Real-world exploitation signals are currently low — EPSS is 0.48% (top 62% percentile, not top-tier), there's no CISA KEV entry, no public PoC, and no Nuclei template, and CISA's SSVC verdict is TRACK rather than Act/Attend. However, the qualitative risk is elevated because the bug silently bypasses trust_remote_code, the primary control teams use today to gate untrusted model code — organizations relying on that flag as a compensating control have a false sense of safety. The package itself carries above-average risk (OpenSSF Scorecard 6.5/10, 34 other historical CVEs), so this should be treated as a high-priority patch even without active exploitation evidence.

How does the attack unfold?

Malicious Repo Publication

Attacker publishes a model repository on Hugging Face Hub containing a backdoored custom attention implementation.

AML.T0058

Config-Based Delivery

Attacker crafts config.json with _attn_implementation_internal pointing to their repo and distributes it via a plausible or typosquatted model name.

AML.T0011.000

Victim Model Load

Victim calls AutoModelForCausalLM.from_pretrained(), triggering unsanitized deserialization of the config and silent download of the attacker's code.

AML.T0011

Arbitrary Code Execution

The attacker's code executes with the victim process's full OS privileges, bypassing the trust_remote_code safeguard entirely.

AML.T0010.003

Malicious Repo Publication

Attacker publishes a model repository on Hugging Face Hub containing a backdoored custom attention implementation.

AML.T0058

Config-Based Delivery

Attacker crafts config.json with _attn_implementation_internal pointing to their repo and distributes it via a plausible or typosquatted model name.

AML.T0011.000

Victim Model Load

Victim calls AutoModelForCausalLM.from_pretrained(), triggering unsanitized deserialization of the config and silent download of the attacker's code.

AML.T0011

Arbitrary Code Execution

The attacker's code executes with the victim process's full OS privileges, bypassing the trust_remote_code safeguard entirely.

AML.T0010.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Transformers	pip	< 5.3.0	`5.3.0`
164.1K OpenSSF 6.1 9.2K dependents Pushed 2d ago 43% patched ~87d to patch Full package profile →

Do you use Transformers? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade to transformers >= 5.3.0 immediately across all environments — dev, CI, training, and production inference — where models are loaded from Hugging Face Hub. Until fully patched, restrict from_pretrained() calls to an allowlist of vetted, version-pinned model repositories and disable dynamic model-ID resolution from user input. Run model-loading processes in sandboxed, network-restricted containers (no outbound egress except to approved registries) so that even a bypassed trust_remote_code check can't fetch and execute attacker infrastructure. Add detection for anomalous outbound connections or process spawns originating from Python processes invoking transformers during model load, and audit config.json files of any recently loaded third-party models for unexpected _attn_implementation_internal values pointing to non-standard repos.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.003 - Model AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts AML.T0058 - Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Third-party and customer relationships

NIST AI RMF

GOVERN 6.1 - Third-party AI risk management

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-4372?

A newly disclosed flaw in every version of Hugging Face's transformers library prior to 5.3.0 lets an attacker smuggle arbitrary code execution through a model's config.json — abusing an internal `_attn_implementation_internal` field to point at attacker-controlled code on the Hub, and critically, this bypasses the trust_remote_code flag most teams rely on as their safety gate. Given that transformers sits underneath 8,333 downstream packages and is the default loader across countless RAG, fine-tuning, and agent pipelines, any model load — even one a developer believes is 'safe' because trust_remote_code is off — can hand an attacker full OS-level privileges invisibly. There's no public exploit, no CISA KEV listing, and EPSS sits at a modest 0.48% (top 62nd percentile) with an SSVC verdict of TRACK, so this isn't being mass-exploited today — but the technique itself requires no advanced tooling, just a poisoned Hub repo and a victim who calls AutoModelForCausalLM.from_pretrained(). Patch to transformers 5.3.0+ immediately across every environment that loads Hub models, and in the interim restrict model loading to vetted, pinned repos and sandbox the load process so a bypassed trust_remote_code check can't translate into host compromise.

Is CVE-2026-4372 actively exploited?

No confirmed active exploitation of CVE-2026-4372 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-4372?

Upgrade to transformers >= 5.3.0 immediately across all environments — dev, CI, training, and production inference — where models are loaded from Hugging Face Hub. Until fully patched, restrict from_pretrained() calls to an allowlist of vetted, version-pinned model repositories and disable dynamic model-ID resolution from user input. Run model-loading processes in sandboxed, network-restricted containers (no outbound egress except to approved registries) so that even a bypassed trust_remote_code check can't fetch and execute attacker infrastructure. Add detection for anomalous outbound connections or process spawns originating from Python processes invoking transformers during model load, and audit config.json files of any recently loaded third-party models for unexpected `_attn_implementation_internal` values pointing to non-standard repos.

What systems are affected by CVE-2026-4372?

This vulnerability affects the following AI/ML architecture patterns: model serving, RAG pipelines, training pipelines, agent frameworks.

What is the CVSS score for CVE-2026-4372?

CVE-2026-4372 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

model servingRAG pipelinestraining pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011 User Execution

AML.T0011.000 Unsafe AI Artifacts

AML.T0058 Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue.

Exploitation Scenario

An attacker publishes a model repository on Hugging Face Hub with a plausible name (e.g., a fine-tuned variant of a popular open model) and includes a config.json where `_attn_implementation_internal` references a second attacker-controlled repo hosting a malicious 'custom kernel'. The attacker promotes the model via a blog post, forum recommendation, or typosquatted name to lure a victim — a data scientist, MLOps engineer, or automated pipeline — into using it. When the victim runs AutoModelForCausalLM.from_pretrained('attacker/model'), transformers deserializes the config, resolves the internal field, and silently downloads and executes the attacker's code, even though the victim never enabled trust_remote_code. The payload then runs with the full OS privileges of the loading process — enabling credential theft, lateral movement, or persistence — while the victim sees no visible indication anything abnormal occurred.

Weaknesses (CWE)

CWE-1066 Missing Serialization Control Element Primary CWE-502 Deserialization of Untrusted Data Primary

CWE-1066 — Missing Serialization Control Element: The product contains a serializable data element that does not have an associated serialization method.

Source: MITRE CWE corpus.