Database/AI/ML frameworks & serving
Hugging Face Transformers: megatron_gpt2 checkpoint parsing deserializes untrusted data into code execution
Impact
Loading a crafted Megatron-GPT2 checkpoint runs attacker code in the loading process. On a GPU node that is the training or serving worker itself, with its GPU devices, mounted dataset and checkpoint shares, and any Kubernetes service account or cloud credential the pod carries. Fleets that ingest externally produced Megatron checkpoints - a common path when converting weights from another training stack - take this on every conversion run. ZDI reports version 4.55.0 as affected.
Who can reach it
No authentication needed against the library; the attacker must supply a checkpoint that a process loads. In practice: any tenant or pipeline that can place a file in a watched model directory or registry that conversion jobs read.
What to do
The record names no fixed version. Until one lands, run checkpoint conversion in an isolated container with no cluster credentials and no write access to shared model stores, and allowlist the sources jobs may load from. The eventual fix is a pip upgrade plus a restart of the affected training or inference processes.
References
Related entries
- Hugging Face Accelerate: checkpoint parsing deserializes untrusted data into code executionCVE-2025-14925 · Hugging Face Accelerate (checkpoint loader)High
- Hugging Face Transformers: convert_config executes strings from a checkpoint in three speech model convertersCVE-2025-14926 · Hugging Face Transformers (SEW, SEW-D and HuBERT convert_config)High
- Hugging Face Transformers: X-CLIP checkpoint conversion deserializes untrusted data into code executionCVE-2025-14929 · Hugging Face Transformers (X-CLIP checkpoint conversion)High
- Hugging Face Transformers: GLM4 weight parsing deserializes untrusted data into code executionCVE-2025-14930 · Hugging Face Transformers (GLM4 weight loader)High
- LlamaIndex CLI: OS command injection via the `--files` argumentCVE-2025-1753 · LlamaIndex CLIHigh
- nbconvert: Template-driven conversion executes attacker contentCVE-2025-53000 · nbconvertHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.