Database/AI/ML frameworks & serving
Hugging Face Diffusers: CogView4 checkpoint parsing deserializes untrusted data into code execution
Impact
A model file that a user or job loads through the CogView4 checkpoint path executes attacker code inside the loading process. On a GPU node that process usually holds the CUDA context, the service account token and whatever model and dataset mounts the job was given, so the attacker inherits the job's identity rather than just crashing it. Where diffusers is driven by a shared inference or fine-tuning service that accepts user-supplied checkpoints, this is remote code execution against that service. ZDI rates it 7.8 with user interaction required - someone or something has to load the file.
Who can reach it
No authentication to the library itself; the attacker needs to get a crafted checkpoint in front of a process that loads it - an uploaded model, a Hub artifact, a pipeline that pulls weights from an untrusted path. Execution lands with the privileges of the loading process.
What to do
No fixed version is named in the record. Treat untrusted checkpoints as untrusted code: restrict which repos and paths jobs may load from, prefer safetensors, and run checkpoint conversion and loading in a throwaway container without cluster credentials. Patching is a Python package upgrade and a restart of the serving or training process once a fixed release is published - no node maintenance.
References
Related entries
- Hugging Face Transformers: megatron_gpt2 checkpoint parsing deserializes untrusted data into code executionCVE-2025-14924 · Hugging Face Transformers (megatron_gpt2 checkpoint loader)High
- Hugging Face Accelerate: checkpoint parsing deserializes untrusted data into code executionCVE-2025-14925 · Hugging Face Accelerate (checkpoint loader)High
- Hugging Face Transformers: convert_config executes strings from a checkpoint in three speech model convertersCVE-2025-14926 · Hugging Face Transformers (SEW, SEW-D and HuBERT convert_config)High
- Hugging Face Transformers: X-CLIP checkpoint conversion deserializes untrusted data into code executionCVE-2025-14929 · Hugging Face Transformers (X-CLIP checkpoint conversion)High
- Hugging Face Transformers: GLM4 weight parsing deserializes untrusted data into code executionCVE-2025-14930 · Hugging Face Transformers (GLM4 weight loader)High
- LlamaIndex CLI: OS command injection via the `--files` argumentCVE-2025-1753 · LlamaIndex CLIHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.