CVE-2026-1839 PUBLISHED

Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers

Assigner: @huntr_ai
Reserved: 03.02.2026 Published: 07.04.2026 Updated: 07.04.2026

A vulnerability in the HuggingFace Transformers library, specifically in the Trainer class, allows for arbitrary code execution. The _load_rng_state() method in src/transformers/trainer.py at line 3059 calls torch.load() without the weights_only=True parameter. This issue affects all versions of the library supporting torch>=2.2 when used with PyTorch versions below 2.6, as the safe_globals() context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as rng_state.pth, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.

Metrics

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H
CVSS Score: 6.5

Product Status

Vendor huggingface
Product huggingface/transformers
Versions
  • affected from unspecified to v5.0.0rc3 (excl.)

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE