Transformers Vulnerabilities

pip ML Libraries

AI Threat Alert tracks 37 known vulnerabilities in Transformers, 5 rated critical — an AI/ML ml libraries in the pip ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources
62
Risk Score
37
Total CVEs
5
Critical
pip
Ecosystem
Aug 17, 2026
Last CVE
43%
Patch Rate
87d
Avg Time to Patch
164,125 stars 34,251 forks 2,382 issues 9,223 dependents Last push Aug 15, 2026
View on GitHub
OpenSSF Scorecard 6.1/10

Known Vulnerabilities (37 total, page 1 of 2)

Severity CVE ID Summary CVSS Published
MEDIUM CVE-2026-75104 Transformers: path traversal via checkpoint shards 5.5 Aug 17, 2026 CRITICAL CVE-2026-63767 ktransformers: unauth pickle RCE via ZMQ socket 9.8 Jul 20, 2026 HIGH CVE-2026-4372 transformers: config.json RCE bypasses trust_remote_code 7.8 May 26, 2026 LOW CVE-2026-55542 Snipe-IT: auth bypass exposes S3 signature image URLs -- Jun 23, 2026 CRITICAL CVE-2026-26210 KTransformers: pickle RCE via unauthenticated ZMQ socket 9.8 Apr 23, 2026 CRITICAL CVE-2026-5241 transformers: trust_remote_code bypass enables RCE via model load 9.6 Jun 3, 2026 CRITICAL CVE-2026-47117 OpenMed: RCE via trust_remote_code model loading 9.8 Jun 2, 2026 HIGH CVE-2026-46432 lmdeploy: hardcoded trust_remote_code enables RCE 7.8 May 21, 2026 MEDIUM CVE-2026-7669 SGLang: deserialization in tokenizer loader enables RCE 5.6 May 2, 2026 MEDIUM CVE-2026-1839 HuggingFace Transformers: RCE via malicious checkpoint load 6.5 Apr 7, 2026 UNKNOWN CVE-2025-14930 transformers: Deserialization enables RCE -- Dec 23, 2025 UNKNOWN CVE-2025-14929 transformers: Deserialization enables RCE -- Dec 23, 2025 UNKNOWN CVE-2025-14928 transformers: Code Injection enables RCE -- Dec 23, 2025 UNKNOWN CVE-2025-14927 transformers: Code Injection enables RCE -- Dec 23, 2025 UNKNOWN CVE-2025-14926 transformers: Code Injection enables RCE -- Dec 23, 2025 UNKNOWN CVE-2025-14924 transformers: Deserialization enables RCE -- Dec 23, 2025 UNKNOWN CVE-2025-14921 transformers: Deserialization enables RCE -- Dec 23, 2025 UNKNOWN CVE-2025-14920 transformers: Deserialization enables RCE -- Dec 23, 2025 HIGH CVE-2025-6921 Transformers: ReDoS in optimizer halts training pipelines 7.5 Sep 23, 2025 MEDIUM CVE-2025-6051 Transformers: ReDoS in EnglishNormalizer exhausts CPU 5.3 Sep 14, 2025 HIGH CVE-2025-6638 HuggingFace Transformers: ReDoS in MarianTokenizer 7.5 Sep 12, 2025 MEDIUM CVE-2025-5197 Transformers: ReDoS in TF-to-PyTorch weight converter 5.3 Aug 6, 2025 MEDIUM CVE-2025-3933 Transformers: ReDoS in DonutProcessor causes DoS 5.3 Jul 11, 2025 LOW CVE-2025-3777 Transformers: URL validation bypass exposes image pipeline 3.5 Jul 7, 2025 MEDIUM CVE-2025-3264 Transformers: ReDoS in dynamic module loader causes DoS 5.3 Jul 7, 2025

Showing 1–25 of 37

Frequently asked questions

What is Transformers?

Transformers is an AI/ML ml libraries tracked by AI Threat Alert for security vulnerabilities in the pip ecosystem.

How many known vulnerabilities does Transformers have?

Transformers has 37 known CVEs, 5 of them critical, tracked from NVD and GitHub Advisory.

Which ecosystem is Transformers distributed in?

Transformers is distributed via the pip ecosystem and categorized as ml libraries.

Where does the Transformers vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of Transformers?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor Transformers in your stack

Get instant alerts when new vulnerabilities affect Transformers. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring