Hugging Face

LeRobot Unsafe Deserialization Remote Code Execution via gRPC

also in 1 other product

Huggingface/text-generation-inference: Uncontrolled Resource Consumption

Sandbox Escape Vulnerability in huggingface/smolagents

Hugging Face Transformers: Deserialization of Untrusted Data

also in 1 other product

Hugging Face Transformers: Deserialization of Untrusted Data

also in 1 other product

Hugging Face Transformers: Deserialization of Untrusted Data

also in 1 other product

Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components

Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder

Diffusers: None.py Trust Remote Code Bypass

Hugging Face Smolagents: Code Injection

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

Huggingface/transformers: Missing Serialization Control Element

Deserialization of Untrusted Data in huggingface/transformers

Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers

Deserialization of Untrusted Data in huggingface/transformers

Arbitrary Code Execution via Deserialization in huggingface/transformers

text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions

tokenizers BpeBuilder Buffer Overflow via merge token

Datasets Path Traversal via Unsanitized file_name Metadata

Path Traversal in huggingface/transformers

Diffusers: TOCTOU Trust Remote Code Bypass

Huggingface/transformers: Deserialization of Untrusted Data

Hugging Face Transformers Path Traversal via Checkpoint Index

Hugging Face Transformers: Deserialization of Untrusted Data

also in 1 other product

Hugging Face Transformers: Deserialization of Untrusted Data

also in 1 other product