Hugging Face Transformers: untrusted deserialization when loading Perceiver and Transformer-XL model files

Impact

Loading a crafted model file through the Perceiver or Transformer-XL code paths deserializes untrusted data and executes code as the user running the load. ZDI split this across two ids (CVE-2025-14920 for Perceiver, CVE-2025-14921 for Transformer-XL); it is the same class of flaw in the same component, the same affected version line (4.54.1), and the same operator action. On a GPU fleet the exposure is any pipeline that pulls weights a tenant or a public hub supplied - fine-tuning jobs, serving pods that fetch a checkpoint at startup, notebook users loading a shared model. Code runs with the job's identity, so it reaches the registry pull secrets, the shared checkpoint store and the node's GPU devices. It is not remote-unauthenticated: something or someone must load the attacker's file.

Who can reach it

Anyone who can get a model file in front of a loading process - submit a checkpoint to a training or serving pipeline, publish weights a job fetches, or get a user to open a malicious file. User or job interaction is required; no prior authentication to the library itself.

What to do

Upgrade transformers past the affected 4.54.1 line; the ZDI advisories name no fixed version, so confirm against upstream before committing a window. Meanwhile treat model files as untrusted input: prefer safetensors, block pickle-backed checkpoints at ingest, and run model loading in a pod that holds no shared credentials. Rollout is a rebuild of the serving/training image plus a pod restart - no node drain or reboot.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Hugging Face Diffusers: CogView4 checkpoint parsing deserializes untrusted data into code executionCVE-2025-14922 · Hugging Face Diffusers (CogView4 checkpoint loader)High
• Hugging Face Transformers: megatron_gpt2 checkpoint parsing deserializes untrusted data into code executionCVE-2025-14924 · Hugging Face Transformers (megatron_gpt2 checkpoint loader)High
• Hugging Face Accelerate: checkpoint parsing deserializes untrusted data into code executionCVE-2025-14925 · Hugging Face Accelerate (checkpoint loader)High
• Hugging Face Transformers: convert_config executes strings from a checkpoint in three speech model convertersCVE-2025-14926 · Hugging Face Transformers (SEW, SEW-D and HuBERT convert_config)High
• Hugging Face Transformers: X-CLIP checkpoint conversion deserializes untrusted data into code executionCVE-2025-14929 · Hugging Face Transformers (X-CLIP checkpoint conversion)High
• Hugging Face Transformers: GLM4 weight parsing deserializes untrusted data into code executionCVE-2025-14930 · Hugging Face Transformers (GLM4 weight loader)High