Hugging Face Transformers: X-CLIP checkpoint conversion deserializes untrusted data into code execution

Impact

Converting an X-CLIP checkpoint deserializes attacker-controlled data and executes code in the converting process. The exposure is the ingest path: multimodal weights pulled from a public hub, converted on a GPU node, then published to a shared model store. Code runs with the converting user's credentials, which in many fleets means write access to the model registry every tenant then loads from. ZDI reports version 5.0.0 as affected, which is a separate code path and a separate release line from the other Transformers ids in this batch.

Who can reach it

No authentication needed against the library; the attacker supplies the checkpoint that a conversion job or engineer runs against. Execution is in the context of that process.

What to do

The record names no fixed version. Run conversions in an isolated container with no registry write access and no cluster credentials, and allowlist the checkpoint sources that ingest jobs accept. Remediation once a release lands is a pip upgrade and a restart of the affected jobs.

References

Related entries

• Hugging Face Transformers: GLM4 weight parsing deserializes untrusted data into code executionCVE-2025-14930 · Hugging Face Transformers (GLM4 weight loader)High
• LlamaIndex CLI: OS command injection via the `--files` argumentCVE-2025-1753 · LlamaIndex CLIHigh
• nbconvert: Template-driven conversion executes attacker contentCVE-2025-53000 · nbconvertHigh
• Linux i915 GPU kernel driver (execbuffer VMA array): The execbuffer VMA array was not zero-initialised, soCVE-2025-71130 · Linux i915 GPU kernel driver (execbuffer VMA array)High
• Keras: Safe-mode bypass in Keras 3.0.0–3.10.0CVE-2025-8747 · KerasHigh
• Keras (`TorchModuleWrapper`): Unsafe deserialization of attacker-controlled PyTorch pickle inside a Keras modelCVE-2026-12484 · Keras (`TorchModuleWrapper`)High